CVE-2025-8780

Executive Summary

CVE-2025-8780 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Livemesh SiteOrigin Widgets plugin for WordPress, up to and including version 3.9.1. The flaw resides in the plugin's Hero Header and Pricing Table widgets, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least Contributor-level access can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for broad impact due to stored persistence.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for official patches. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access.
• User Interaction (UI): None (N) – No victim action needed beyond page visit.
• Scope (S): Changed (C) – Compromised host vs. vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The need for authentication reduces the attack surface, but the stored nature of the XSS makes it dangerous for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Hero Header and Pricing Table widgets provided by the Livemesh SiteOrigin Widgets plugin. These widgets accept user-defined attributes (e.g., CSS classes, custom text, or data attributes) that are rendered directly into the HTML output without proper sanitization or escaping.

Root Cause:

• The plugin uses esc_attr() or esc_html() inconsistently, or not at all, for certain widget attributes.
• An attacker with Contributor-level access can create or edit a page/post using these widgets and inject malicious JavaScript into an attribute field (e.g., class, style, or a custom data attribute).
• When the page is rendered, the injected script is stored in the database and executed in the browser of any visitor.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Creates a new page or edits an existing one.
3. Adds a Hero Header or Pricing Table widget.
4. Injects a payload like "><script>alert('XSS')</script> into an unsanitized attribute.
5. Publishes or saves the page.
6. Any user (including admins) visiting the page triggers the script.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Example):

// In widget output
echo '<div class="' . $instance['custom_class'] . '">';
// $instance['custom_class'] is not sanitized

Patched Code (Expected):

// Properly escape output
echo '<div class="' . esc_attr($instance['custom_class']) . '">';

The fix requires consistent use of esc_attr() for HTML attributes and esc_html() or wp_kses() for text content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Livemesh SiteOrigin Widgets <= 3.9.1.
• User account with Contributor-level privileges.

Exploit Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Pages > Add New.
3. Add a SiteOrigin block and select Hero Header or Pricing Table.
4. In the widget settings, locate an attribute field (e.g., "Custom CSS Class" or "Heading Text").
5. Inject a payload such as:

   " onfocus="alert(1)" autofocus="true
   

   or

   "><img src=x onerror=alert(document.cookie)>
   

6. Save/publish the page.
7. Trigger the XSS by visiting the page as any user.

No public exploit code is available at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for patterns like onerror=, onfocus=, <script>, or javascript: in custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in POST requests.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Disable the plugin if not essential.
• Apply input validation and output escaping via a custom plugin or theme functions.php:

  add_filter('siteorigin_widgets_instance', function($instance, $widget) {
      if (in_array($widget, ['hero-header', 'pricing-table'])) {
          foreach ($instance as $key => $value) {
              $instance[$key] = esc_attr($value);
          }
      }
      return $instance;
  }, 10, 2);
  

Indicators of Compromise (IOCs)

• File-based:

  • Modified page/post content containing <script> tags or event handlers in widget attributes.
  • Suspicious entries in wp_posts table with post_content containing XSS payloads.

• Network-based:

  • HTTP requests to /wp-admin/admin-ajax.php with widget data containing JavaScript.
  • Outbound connections to attacker-controlled domains from compromised pages.

• Log-based:

  • WordPress debug log entries showing unexpected HTML/JS in widget rendering.
  • Web server access logs with POST requests to /wp-admin/post.php containing encoded XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2025_8780_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Livemesh SiteOrigin Widgets"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8780"
    strings:
        $xss1 = /on\w+\s*=\s*['\"].*?script.*?['\"]/i
        $xss2 = /<script[\s>]/i
        $xss3 = /javascript\s*:/i
        $xss4 = /<img[^>]+onerror\s*=/i
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-8780 Stored XSS in Livemesh SiteOrigin Widgets
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress page/post content
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post.php'
        cs-uri-query|contains:
            - 'onerror='
            - 'onfocus='
            - '<script'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-8780 Stored XSS Payload in POST"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"onerror="; nocase; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review and clean any existing pages/posts using the Hero Header or Pricing Table widgets.
3. Restrict Contributor-level accounts to only trusted users.

Long-term Fix:

• Apply a virtual patch via WAF to block XSS payloads in widget attributes.
• Monitor the plugin's official repository for a patched version (expected > 3.9.1).
• Consider replacing the plugin with an alternative that has active security maintenance.

Workaround:

• Add custom sanitization via a WordPress plugin or theme functions.php as shown in the Blue Team section.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst