CVE-2025-64225

Executive Summary

CVE-2025-64225 is a stored cross-site scripting (XSS) vulnerability in the Stockie Extra WordPress plugin (version <= 1.2.11) developed by Colabrio. The plugin fails to properly neutralize script-related HTML tags in a web page, allowing an attacker to inject arbitrary JavaScript code. This vulnerability is classified as a Basic XSS (CWE-80) and can lead to code injection within the context of the WordPress admin dashboard or frontend, depending on where the vulnerable input is rendered.

Given that this is a WordPress plugin vulnerability, the attack surface is limited to sites running the Stockie Extra plugin. The CVSS score of 6.5 (Medium) reflects the need for user interaction (e.g., an admin viewing a crafted page) and the partial impact on confidentiality and integrity. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository or third-party marketplaces. Organizations using Stockie Extra should treat this as a supply chain risk, as the plugin may be bundled with themes or other plugins. No OSV or GitHub advisory data is available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the injection.
• User Interaction: Required (UI:R) – The victim must click or view the crafted content.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No denial-of-service impact.

Threat Level: Medium. The lack of public exploits and low EPSS score reduce immediate risk, but the vulnerability is trivial to exploit once discovered.

Deep Dive & Mechanics

The vulnerability resides in the Stockie Extra plugin, which likely provides additional functionality (e.g., custom widgets, shortcodes, or page builders) for the Stockie WordPress theme. The plugin fails to sanitize user-supplied input before rendering it in a web page, allowing an attacker to inject HTML tags that can execute JavaScript.

Attack Flow:

1. An attacker identifies an input field (e.g., a comment, custom field, or shortcode parameter) that is not properly sanitized.
2. The attacker submits a payload such as <script>alert('XSS')</script> or <img src=x onerror=alert(1)>.
3. When an administrator or user views the page containing the injected content, the script executes in their browser.
4. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or print without applying WordPress's built-in escaping functions (e.g., esc_html(), wp_kses_post(), or esc_attr()). This allows raw HTML/JavaScript to be rendered.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (stockie-extra <= 1.2.11):

<?php
// Example: Displaying user input without sanitization
echo '<div class="custom-widget">' . $user_input . '</div>';
?>

Patched Code (hypothetical):

<?php
// Properly escape output
echo '<div class="custom-widget">' . esc_html( $user_input ) . '</div>';
?>

The patched version uses esc_html() to convert special characters (e.g., <, >, &) into HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Stockie Extra plugin version <= 1.2.11.
• An input field that is not sanitized (e.g., a custom widget title, shortcode parameter, or comment field).

Exploitation Steps:

1. Identify the vulnerable input. For example, if the plugin has a shortcode [stockie_extra title="User Input"], inject:

   [stockie_extra title="<script>alert('XSS')</script>"]
   

2. Alternatively, if the plugin stores data in a custom post meta, submit via a form:

   <img src=x onerror=alert(document.cookie)>
   

3. When an admin visits the page, the script executes.

No public exploit code is available. The above is a generic XSS exploitation scenario.

Blue Team (Defender)

Detection:

• Monitor for unusual input patterns in plugin-related fields (e.g., <script>, onerror, onload).
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Review server logs for requests containing script tags in parameters.

Mitigation:

• Disable or remove the Stockie Extra plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use WordPress security plugins (e.g., Wordfence, Sucuri) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing <script>, onerror, onload, or javascript: in parameters related to Stockie Extra.
  • Outbound connections to attacker-controlled domains (e.g., for cookie exfiltration).

• File IOCs:

  • Modified plugin files (e.g., stockie-extra.php) containing injected JavaScript.
  • Suspicious entries in the WordPress wp_postmeta or wp_options table.

• Behavioral IOCs:

  • Unexpected admin user creation or privilege escalation.
  • Unusual outbound traffic from the WordPress server.

Detection Engineering

YARA Rule

rule CVE_2025_64225_XSS_StockieExtra {
    meta:
        description = "Detects XSS payloads targeting Stockie Extra plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64225"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+["']?/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+["']?/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-64225 XSS in Stockie Extra Plugin
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects XSS attempts against Stockie Extra WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panels (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64225 XSS in Stockie Extra Plugin"; flow:to_server,established; content:"stockie-extra"; http_uri; nocase; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or uninstall the Stockie Extra plugin until a patched version is released.
2. Short-term: Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Long-term: Apply input validation and output escaping in all custom WordPress plugins. Use WordPress's built-in functions like esc_html(), esc_attr(), and wp_kses_post().
4. Monitoring: Enable logging for all plugin-related requests and review for suspicious patterns.
5. Patch: Monitor the Colabrio website or WordPress plugin repository for an update. Apply immediately when available.

Report generated by Valters IT DevSecOps & CTI Division