CVE-2025-26567

Executive Summary

CVE-2025-26567 is a DOM-Based Cross-Site Scripting (XSS) vulnerability found in the Font Awesome WP WordPress plugin, developed by farjana55. This plugin, up to and including version 1.0, fails to properly neutralize user-controlled input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser. The vulnerability is triggered entirely on the client side (DOM), meaning no server-side request is required for the payload to execute. Given that this is a WordPress plugin, the attack surface is broad, as WordPress powers a significant portion of the web. The lack of a known patch and the plugin's continued availability make this a persistent threat for unmaintained sites.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed through the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. The supply chain risk is significant: site administrators who install this plugin from the directory are trusting the vendor (farjana55) to maintain security. With no patch available, any site running version 1.0 is vulnerable. The plugin's code is directly embedded into the WordPress site, meaning a compromise of the plugin's source (e.g., via a malicious update) could lead to widespread exploitation. Administrators should immediately remove or replace the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The attack is launched over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a link or visit a crafted page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the prevalence of WordPress and the lack of a patch elevate the real-world risk. DOM-based XSS can be used to steal session cookies, deface pages, or perform phishing attacks.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the Font Awesome WP plugin. Unlike reflected or stored XSS, DOM-based XSS occurs when JavaScript in the page processes user input from the URL fragment (hash) or other client-side sources and writes it to the DOM without proper sanitization.

Mechanism:

1. The plugin likely reads a value from window.location.hash or document.URL to dynamically load or display Font Awesome icons.
2. This value is then inserted into the DOM via innerHTML, document.write, or similar methods without escaping.
3. An attacker crafts a URL like: https://victim.com/?page_id=123#<img src=x onerror=alert(1)>
4. When the victim visits this URL, the JavaScript in the plugin extracts the hash value and injects it into the page, causing the attacker's script to execute.

Root Cause: The plugin uses innerHTML or jQuery.html() to set content based on the URL hash, failing to sanitize the input. The fix would involve using textContent or innerText instead, or properly encoding HTML entities.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

// font-awesome-wp.js (v1.0)
var hash = window.location.hash.substring(1);
document.getElementById('fa-icon-display').innerHTML = '<i class="fa ' + hash + '"></i>';

Patched Code (Conceptual):

// font-awesome-wp.js (patched)
var hash = window.location.hash.substring(1);
var safeHash = document.createTextNode(hash);
document.getElementById('fa-icon-display').appendChild(safeHash);
// Or use textContent:
// document.getElementById('fa-icon-display').textContent = hash;

The patched version avoids innerHTML entirely, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Font Awesome WP v1.0 installed and active.
• The plugin must be rendering the hash value into the DOM (e.g., on a page that uses the plugin's shortcode).

Exploit Steps:

1. Identify a page on the target site that uses the Font Awesome WP plugin (e.g., a page with the shortcode [font-awesome-wp]).
2. Craft a malicious URL:

   https://target-site.com/page-with-plugin/#<img src=x onerror=alert(document.cookie)>
   

3. Send this URL to the victim via email, social engineering, or a redirect.
4. When the victim visits the URL, the JavaScript executes, stealing their cookies or performing other actions.

Proof-of-Concept (PoC) Code:

<!-- Save as poc.html and host on attacker server -->
<!DOCTYPE html>
<html>
<body>
<script>
// Simulate the vulnerable plugin behavior
var hash = window.location.hash.substring(1);
document.write('<div id="output">' + hash + '</div>');
</script>
</body>
</html>

Visit: poc.html#<img src=x onerror=alert('XSS')>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing <script, onerror, onload, or other XSS patterns in the URL fragment (hash). Note that the hash is not sent to the server, so server-side logging is ineffective. Use client-side monitoring (e.g., CSP reports).
• Deploy a Content Security Policy (CSP) that blocks inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Use a Web Application Firewall (WAF) that can inspect URL fragments (some WAFs can do this via JavaScript injection).

Hardening:

• Immediately remove or replace the Font Awesome WP plugin.
• If removal is not possible, manually patch the plugin by editing the JavaScript file to use textContent instead of innerHTML.
• Implement Subresource Integrity (SRI) for all external scripts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing #<script, #<img, #<svg, or other HTML tags in the fragment.
  • Referer headers pointing to crafted URLs with XSS payloads.
• Host IOCs:
  • Presence of the file /wp-content/plugins/font-awesome-wp/font-awesome-wp.js (version 1.0).
  • Unexpected JavaScript execution in the browser (detectable via browser dev tools or CSP violation reports).
• File IOCs:
  • MD5 hash of the vulnerable plugin file: UNKNOWN (not provided).
  • SHA256 hash of the vulnerable plugin file: UNKNOWN.

Detection Engineering

YARA Rule

rule CVE_2025_26567_DOM_XSS {
    meta:
        description = "Detects vulnerable Font Awesome WP plugin v1.0 with DOM XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26567"
    strings:
        $vuln_func1 = "innerHTML" ascii wide nocase
        $vuln_func2 = "document.write" ascii wide nocase
        $vuln_func3 = "location.hash" ascii wide nocase
        $plugin_id = "font-awesome-wp" ascii wide nocase
    condition:
        all of ($vuln_func*) and $plugin_id
}

Sigma Rule

title: CVE-2025-26567 DOM XSS in Font Awesome WP Plugin
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects potential exploitation of DOM-based XSS in Font Awesome WP plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
            - '#onerror'
            - '#onload'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with HTML-like content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#<img"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#<svg"; http_uri; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#<iframe"; http_uri; nocase; sid:1000004; rev:1;)
alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#onerror"; http_uri; nocase; sid:1000005; rev:1;)
alert http any any -> any any (msg:"CVE-2025-26567 DOM XSS in Font Awesome WP Plugin"; flow:to_server,established; content:"#onload"; http_uri; nocase; sid:1000006; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete the Font Awesome WP plugin from all WordPress installations.
2. Replace with an alternative: Use a well-maintained Font Awesome plugin (e.g., "Font Awesome" by Font Awesome) or manually include the Font Awesome CDN.
3. Scan for compromise: Check for any signs of XSS exploitation (e.g., unexpected admin users, modified content).

Long-Term Mitigation:

• Implement a Content Security Policy (CSP) with script-src 'self' and 'unsafe-inline' disabled.
• Regularly audit all WordPress plugins for vulnerabilities.
• Use a Web Application Firewall (WAF) with virtual patching for known XSS patterns.
• Educate users about phishing links containing hash fragments.

Patch Status: UNKNOWN / UNPATCHED. The vendor (farjana55) has not released a fix. Site administrators must rely on the mitigations above.

Valters IT