CVE-2025-0717 – Social Slider Feed < 2.2.9 – Stored XSS to JS Backdoor Creation – POC

The security of WordPress plugins is crucial for website integrity, as vulnerabilities can expose sites to attacks that compromise data and user trust. One such critical issue has been identified in the Photo Gallery, Images, Slider in Rbs Image Gallery plugin, affecting versions below 3.2.24. This vulnerability, CVE-2024-13384, allows attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability, leading to JavaScript backdoor creation. This article provides an in-depth analysis of the discovery, exploitation, and potential risks, along with recommendations to mitigate this issue.

CVE	CVE-2025-0717
Plugin	Social Slider Feed < 2.2.9
Critical	High
All Time	2 647 896
Active installations	30 000+
Publicly Published	March 20, 2025
Last Updated	March 20, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0717 https://wpscan.com/vulnerability/31f734fc-d474-46b3-98eb-04761cab8878/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

The vulnerability was identified in the “Social Slider Feed” plugin, which enables website owners to display social media feeds via widgets. During security analysis, it was discovered that input fields within the widget settings did not properly sanitize user-supplied data, leading to the possibility of executing stored XSS payloads. By injecting malicious JavaScript code into the widget title field, an attacker can execute scripts when a user visits a page containing the compromised widget.

A proof-of-concept (PoC) payload demonstrating this issue is:

By injecting this payload, attackers can trigger script execution in the context of the affected site.

Understanding of XSS attack’s

Stored XSS vulnerabilities occur when user input is improperly handled and then stored in the database. Unlike reflected XSS, which requires immediate execution via a manipulated URL, stored XSS persists on the server and executes whenever a user loads the affected page.

In WordPress, common entry points for stored XSS include:

• Widget settings (as in this case)
• Comment fields
• Post and page metadata
• User profile fields

Exploiting the XSS Vulnerability

Exploiting this vulnerability follows a simple yet effective process:

POC:

1) Access the Robo Gallery Plugin – Navigate to the WordPress dashboard.
2) Create a New Gallery – Under the “Manage Galleries” tab, add a new gallery.
3) Intercept the Request – Use a proxy tool such as Burp Suite to capture the request when saving the gallery.
4) Modify the rsg_galleryImages Parameter – Inject the XSS payload into this parameter.
5) Save and Trigger Execution – Once stored, the payload executes when an administrator or user views the gallery.
   - Steal administrator session cookies
   - Modify page content
   - Inject a persistent JavaScript backdoor

____

If this payload is inserted into a vulnerable field and saved in the database, it will execute every time an admin or visitor loads the page containing the widget.

Recommendations for Improved Security

To mitigate the risks posed by CVE-2025-0717, administrators should immediately update the Social Slider Feed plugin to the latest patched version once it becomes available. Additionally, all user input fields, especially those used in widget titles and settings, should be properly sanitized and validated to prevent malicious script injection. Implementing a Content Security Policy (CSP) can help restrict the execution of unauthorized scripts and mitigate XSS exploitation. Site administrators should limit the permissions of unauthenticated users, regularly review user roles, and ensure that only trusted users can modify widget settings. Restricting the use of JavaScript in input fields and utilizing sanitization functions such as wp_kses() can further reduce the risk of stored XSS attacks.. To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2025-0717, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.