CVE-2025-13838 Exploit & Vulnerability Analysis

1. Vulnerability Background

What is this vulnerability?

• This is a stored Cross-Site Scripting (XSS) flaw in the WishSuite WordPress plugin.
• The issue exists in the shortcode processing logic for wishsuite_button, where user-supplied shortcode attributes are rendered without sufficient sanitization.
• Specifically, the button_text, button_added_text, and button_exist_text attributes can contain injected HTML/JavaScript.

Why is it critical/important?

• Stored XSS allows attacker-controlled script to persist on the site and execute in the browser of any user who views the affected page.
• In WordPress, this can lead to session theft, privilege escalation, defacement, or malware distribution.
• The vulnerability is exploitable by authenticated users with Contributor-level access or higher, which is a common privilege level on many sites. This lowers the attack barrier compared to administrator-only flaws.

What systems/versions are affected?

• WishSuite plugin for WordPress
• All versions up to and including 1.5.1 are affected
• The issue is fixed in versions after 1.5.1 where the shortcode attributes are sanitized before rendering

2. Technical Details

Root cause analysis

• The plugin uses shortcode_atts() to merge default shortcode attributes with user-provided values.
• The merged attributes are passed directly to Manage_Wishlist::instance()->button_html( $atts );
• button_html() outputs the attribute values into page markup without normalizing or filtering dangerous content.
• As a result, attacker-supplied values can include <script>, event handlers, or other injectable markup.

Attack vector and exploitation conditions

• The attack vector is a malicious shortcode in post content or in a page builder field that processes wishsuite_button.
• An authenticated user with Contributor or higher can insert or edit content containing the shortcode.
• The exploit relies on the plugin rendering the shortcode on a page viewed by another user, causing stored XSS.
• No administrator privileges are required to create the payload; only the ability to publish or save content that includes shortcodes.

Security implications

• Stored XSS in a frontend shortcode can affect administrators, editors, and site visitors.
• It can be used to hijack admin sessions, modify content, install backdoors, or execute actions on behalf of users.
• Because the payload is stored, the impact persists until the malicious content is removed.

3. Patch Analysis

What code changes were made?

• The patch adds sanitization immediately after shortcode_atts() and before button_html() is called.
• New code uses wp_kses() on the following attributes:
  • button_text
  • button_added_text
  • button_exist_text
• It references $this->get_allowed_button_html() to define an allowlist of safe HTML tags and attributes, including SVG elements required for button icons.

How do these changes fix the vulnerability?

• wp_kses() strips disallowed HTML and attributes from the shortcode values.
• This prevents injection of scripts, inline event handlers, and other unsafe markup.
• The values passed to button_html() are now sanitized output, eliminating the direct XSS vector.

Security improvements introduced

• Input is normalized at the boundary between user-controlled data and HTML output.
• A custom allowlist enables safe formatting required by the plugin while blocking dangerous content.
• The patch aligns with WordPress best practices for handling shortcode attributes and output escaping.

4. Proof of Concept (PoC) Guide

Prerequisites for exploitation

• A WordPress site running WishSuite plugin version 1.5.1 or earlier
• Authenticated account with Contributor role or higher
• Ability to create or edit content that includes the wishsuite_button shortcode

Step-by-step exploitation approach

1. Create or edit a post/page containing the shortcode: [wishsuite_button button_text="<img src=x>
2. Save the content.
3. Visit the rendered page as another user or in a different browser session.
4. The payload should execute when the page is rendered.