CVE-2025-24774

Executive Summary

CVE-2025-24774 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPCRM - CRM for Contact form CF7 & WooCommerce (slug: wpcrm) developed by mojoomla. The vulnerability exists in versions up to and including 3.2.0. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, will execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 7.1 (High), and the EPSS probability is 0.0%, indicating low active exploitation at the time of analysis. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are not using modified or pirated versions. The plugin's update mechanism should be monitored for a patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - victim must click a crafted link
• Scope: Changed (S:C) - the vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) - limited data exposure
• Integrity Impact: Low (I:L) - limited modification of content
• Availability Impact: Low (A:L) - limited disruption

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the WPCRM plugin. The plugin fails to properly sanitize user-supplied input before reflecting it back in the HTTP response. An attacker can inject malicious JavaScript code into a parameter (likely a query string parameter) that is echoed without encoding. When a victim clicks a crafted link, the injected script executes in the victim's browser, allowing the attacker to perform actions on behalf of the victim, steal cookies, or redirect to malicious sites.

The vulnerable parameter is likely related to the plugin's CRM functionality, such as a search or filter parameter. The plugin does not use WordPress's built-in escaping functions (e.g., esc_html(), esc_attr()) on the reflected data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described. The plugin likely contains code similar to:

// Vulnerable code (wpcrm/includes/class-wpcrm-frontend.php)
echo '<div class="wpcrm-search">' . $_GET['search'] . '</div>';

A patched version would use proper escaping:

// Patched code
echo '<div class="wpcrm-search">' . esc_html( $_GET['search'] ) . '</div>';

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with WPCRM plugin version 3.2.0 on a local server (e.g., using Docker).
2. Craft Payload: Create a URL with a malicious JavaScript payload in a vulnerable parameter. Example:

   http://target/wp-admin/admin.php?page=wpcrm&search=<script>alert('XSS')</script>
   

3. Deliver: Send the crafted link to a victim via email, social engineering, or other means.
4. Execute: When the victim clicks the link, the script executes in their browser.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

1. Detection: Monitor web server logs for requests containing <script> tags or other suspicious patterns in query parameters.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block reflected XSS attempts.
3. Response: If an attack is detected, block the attacker's IP and review logs for compromised accounts.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing patterns like ?search=<script> or ?filter=<img src=x onerror=alert(1)> in the URI.
• Host: Presence of unexpected JavaScript in the browser's DOM after visiting a WPCRM page.
• Logs: Web server access logs showing requests to /wp-admin/admin.php?page=wpcrm with suspicious query parameters.

Detection Engineering

YARA Rule

rule CVE_2025_24774_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against WPCRM plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24774"
    strings:
        $xss1 = /[?&](search|filter|q)=.*<script>/i
        $xss2 = /[?&](search|filter|q)=.*<img[^>]+onerror/i
        $xss3 = /[?&](search|filter|q)=.*onload=/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against WPCRM Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts targeting CVE-2025-24774
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'page=wpcrm'
        cs-uri-query|re:
            - '(search|filter|q)=.*<script'
            - '(search|filter|q)=.*<img.*onerror'
            - '(search|filter|q)=.*onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in search fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24774 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"page=wpcrm"; http_uri; pcre:"/(search|filter|q)=.*<script/i"; pcre:"/(search|filter|q)=.*<img[^>]+onerror/i"; pcre:"/(search|filter|q)=.*onload=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WPCRM plugin until a patch is released.
2. Short-term: Implement a WAF rule to block reflected XSS patterns.
3. Long-term: Monitor the plugin's official page for a patched version (>= 3.2.1). Apply the update as soon as it becomes available.
4. Alternative: Consider using a different CRM plugin that is actively maintained and has a good security track record.

Valters IT
Securing Digital Frontiers