CVE-2025-0864 Overview
CVE-2025-0864 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Active Products Tables for WooCommerce WordPress plugin developed by Pluginus. The flaw exists in the shortcodes_set parameter and affects all versions up to and including 1.0.6.6. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires tricking a user into clicking a crafted link. The vulnerability is tracked under [CWE-79] and carries a CVSS score of 6.1.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and administrative account compromise on affected WooCommerce storefronts.
Affected Products
- Pluginus Active Products Tables for WooCommerce versions up to and including 1.0.6.6
- WordPress sites running the vulnerable plugin
- WooCommerce storefronts using the plugin's shortcode functionality
Discovery Timeline
- 2025-02-18 - CVE-2025-0864 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0864
Vulnerability Analysis
The vulnerability is a Reflected XSS flaw rooted in improper handling of the shortcodes_set request parameter. The plugin reflects the parameter value into rendered page output without sanitizing the input or escaping the output. An attacker crafts a URL containing malicious JavaScript in the shortcodes_set parameter and delivers it to a target user. When the victim loads the crafted URL, the injected script executes within the origin of the affected WordPress site. Because the attack executes in the context of the victim's browser session, an attacker can steal session cookies, perform actions on behalf of the user, or redirect the victim to attacker-controlled infrastructure.
Root Cause
The root cause is missing input validation and missing output escaping in the plugin's handling of the shortcodes_set parameter. WordPress provides functions such as sanitize_text_field() and esc_html() for this purpose, but the vulnerable plugin does not apply them consistently before rendering user-controlled input into the DOM.
Attack Vector
The attack vector is network-based and requires user interaction. An unauthenticated attacker constructs a URL to a page on the target WordPress site with a malicious payload in the shortcodes_set query parameter. The attacker delivers the URL via phishing email, social media, or a malicious website. When the victim clicks the link, the payload reflects into the response and executes. If the victim is an authenticated administrator, the attacker can escalate to account takeover by exfiltrating session tokens or triggering privileged actions.
No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the affected code paths.
Detection Methods for CVE-2025-0864
Indicators of Compromise
- Web server access logs containing requests with shortcodes_set parameter values that include HTML tags, <script> fragments, or URL-encoded JavaScript payloads
- Referrer headers originating from unfamiliar external domains preceding requests to pages rendering the plugin's shortcodes
- Unexpected administrative actions performed shortly after an admin clicked an external link containing plugin parameters
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the shortcodes_set query parameter for script tags, event handlers, and encoded payload patterns
- Enable Content Security Policy (CSP) headers and monitor CSP violation reports for inline script execution attempts on pages using the plugin
- Review WordPress audit logs for privileged actions correlated with reflected URL patterns targeting the affected plugin
Monitoring Recommendations
- Alert on HTTP requests containing shortcodes_set= combined with <, >, javascript:, or on event handler prefixes
- Track outbound requests from administrator browser sessions to unknown domains that may indicate cookie exfiltration
- Monitor plugin version inventory across managed WordPress installations to identify hosts running vulnerable releases at or below 1.0.6.6
How to Mitigate CVE-2025-0864
Immediate Actions Required
- Update the Active Products Tables for WooCommerce plugin to the version released in the vendor changeset that supersedes 1.0.6.6
- Audit administrator accounts for signs of unauthorized activity following the vulnerability disclosure window
- Force-rotate session cookies and administrator credentials on affected WordPress installations
Patch Information
The vendor addressed the vulnerability in a WordPress.org plugin changeset following version 1.0.6.6. Site administrators should upgrade through the WordPress plugin dashboard or by deploying the fixed release from the plugin repository. Reference the WordPress Plugin Changeset for the code changes applied.
Workarounds
- Deactivate the Active Products Tables for WooCommerce plugin until the update can be applied
- Deploy WAF signatures that block requests containing script content in the shortcodes_set parameter
- Implement a strict Content Security Policy that disallows inline scripts on pages served by WordPress
# Example WAF rule (ModSecurity) blocking XSS payloads in shortcodes_set
SecRule ARGS:shortcodes_set "@rx (?i)(<script|javascript:|onerror=|onload=)" \
"id:1000864,phase:2,deny,status:403,msg:'CVE-2025-0864 XSS attempt in shortcodes_set'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
