CVE-2025-10167: WooCommerce Stock Manager XSS Vulnerability

CVE-2025-10167 Overview

CVE-2025-10167 is a stored Cross-Site Scripting (XSS) vulnerability in the Stock History & Reports Manager for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.2.2. It resides in the plugin's alg_wc_stock_snapshot_restocked shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected page. The issue is tracked under CWE-79.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any visitor, including administrators, enabling session theft, forced administrative actions, and account takeover.

Affected Products

Stock History & Reports Manager for WooCommerce (plugin slug: stock-snapshot-for-woocommerce)
All plugin versions ≤ 2.2.2
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-10-11 - CVE-2025-10167 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-10167

Vulnerability Analysis

The vulnerability is a stored XSS issue in a WordPress shortcode handler. Shortcodes accept attributes from the content editor and render output back into the page HTML. When a plugin does not sanitize these attributes on input or escape them on output, attacker-controlled values flow directly into the browser context.

In this plugin, the alg_wc_stock_snapshot_restocked shortcode processes user-supplied attributes and echoes them into the rendered page without protective encoding. A contributor who embeds the shortcode with malicious attribute values causes those payloads to be stored in the post content and executed each time an authenticated user or visitor loads the page.

Because the WordPress contributor role can create draft posts containing arbitrary shortcodes, the barrier to exploitation is low. The scope change reflected in the vulnerability data indicates the injected script can affect resources beyond the vulnerable component, notably other users' browser sessions.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the shortcode implementation located in includes/class-alg-wc-stock-snapshot-shortcodes.php. Attribute values passed to the shortcode are concatenated into HTML output without functions such as esc_html(), esc_attr(), or wp_kses() being applied. Vendor changeset 3376453 addresses the issue by introducing proper escaping. See the WordPress Plugin Code Snippet and WordPress Changeset #3376453.

Attack Vector

An attacker first obtains contributor-level access to a WordPress site running the vulnerable plugin. The attacker then creates or edits a post that embeds the alg_wc_stock_snapshot_restocked shortcode with attribute values containing JavaScript. Once an administrator previews or publishes the post, or a visitor loads the page, the payload executes in the victim's browser under the site's origin. Typical outcomes include cookie theft, forced actions via the WordPress REST API, and privilege escalation through administrator-triggered requests.

No verified public proof-of-concept code is available. Technical details are documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-10167

Indicators of Compromise

Posts, pages, or custom post types containing the alg_wc_stock_snapshot_restocked shortcode with attribute values that include <script>, onerror=, onload=, javascript:, or encoded variants.
Contributor-level accounts creating draft posts that reference stock snapshot shortcodes outside expected editorial workflows.
Outbound requests from administrator browsers to unfamiliar domains shortly after previewing content from a contributor.

Detection Strategies

Query the WordPress wp_posts table for post_content matching the vulnerable shortcode and inspect attribute values for HTML or JavaScript syntax.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution from post pages.
Review web server access logs for suspicious POST requests to /wp-admin/post.php from low-privilege accounts followed by administrator page views.

Monitoring Recommendations

Alert on creation or modification of posts by contributor accounts, particularly when the content contains shortcodes with HTML-like attribute values.
Monitor WordPress audit logs for role changes, new administrator accounts, or plugin installations following contributor activity.
Track outbound network connections from admin sessions to detect exfiltration attempts triggered by executed payloads.

How to Mitigate CVE-2025-10167

Immediate Actions Required

Update the Stock History & Reports Manager for WooCommerce plugin to a version later than 2.2.2 that includes changeset 3376453.
Audit all existing posts and pages for the alg_wc_stock_snapshot_restocked shortcode and remove any suspicious attribute values.
Review user accounts and revoke contributor or higher privileges from any user that is not required to have publishing rights.
Rotate administrator session cookies and passwords if evidence of exploitation is found.

Patch Information

The vendor released a fix in WordPress Changeset #3376453, which adds proper escaping to shortcode attribute output. Download the latest version from the Stock Snapshot for WooCommerce Plugin page on WordPress.org. Verify the installed version through the WordPress plugin management interface after upgrade.

Workarounds

Deactivate and remove the plugin until upgrade is possible if the shortcode functionality is not business-critical.
Restrict the contributor role using an access control plugin to prevent use of the alg_wc_stock_snapshot_restocked shortcode.
Deploy a web application firewall rule to block shortcode attribute values containing script tags, event handlers, or javascript: URIs.

bash

# Verify plugin version and update via WP-CLI
wp plugin get stock-snapshot-for-woocommerce --field=version
wp plugin update stock-snapshot-for-woocommerce

# Search post content for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%alg_wc_stock_snapshot_restocked%';"