CVE-2025-12017: VNPAY Payment Gateway XSS Vulnerability

CVE-2025-12017 Overview

CVE-2025-12017 is a Reflected Cross-Site Scripting (XSS) vulnerability in the VNPAY Payment gateway plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It stems from insufficient input sanitization and output escaping on the message parameter processed by the plugin's Thankyou.php shortcode handler.

Unauthenticated attackers can craft a malicious URL that injects arbitrary JavaScript into the rendered page. Execution requires user interaction, such as clicking a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or administrative action abuse when an administrator is lured to a crafted link.

Affected Products

VNPAY Payment gateway plugin for WordPress (vnpay-for-woocommerce)
All versions through 1.0.0
WordPress sites running WooCommerce with the affected plugin enabled

Discovery Timeline

2025-10-24 - CVE-2025-12017 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12017

Vulnerability Analysis

The VNPAY Payment gateway plugin processes a message query parameter within its Thank You page shortcode logic. The plugin reflects the parameter value into the HTML response without applying sufficient sanitization or output escaping. Any script content supplied through the URL is rendered directly in the response document.

Because the vulnerable endpoint is reachable without authentication, an attacker only needs a victim to visit a specially crafted URL. When the victim is an authenticated WordPress user, particularly an administrator, the injected script executes with that user's session context. This exposes cookies, CSRF tokens, and privileged actions to the attacker.

The EPSS score is 0.205% with a percentile of 10.674, reflecting a low predicted exploitation likelihood at this time.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode file src/shortcodes/Thankyou.php. User-controllable input from the message parameter is echoed into HTML context without functions such as esc_html(), esc_attr(), or wp_kses() applied. This violates WordPress secure coding guidance for handling reflected request data.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker constructs a URL pointing at the WordPress site that contains a payload in the message parameter. The attacker delivers this URL through phishing email, chat, forum posts, or a malicious referrer redirect. When the victim opens the link, the injected script executes in the browser under the origin of the vulnerable site.

The scope is changed per the CVSS vector, indicating the injected script can affect resources beyond the vulnerable component, such as authenticated WordPress admin sessions. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2025-12017

Indicators of Compromise

Web server access logs containing requests to WooCommerce thank-you or order-received pages with a message parameter containing <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
Referrer entries from unfamiliar external domains directing users to plugin endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the site

Detection Strategies

Inspect HTTP request logs for unsanitized script fragments in the message query string on pages rendered by the VNPAY plugin
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS payload patterns targeting the message parameter
Correlate WordPress user activity logs with suspicious inbound URL patterns to identify targeted admins

Monitoring Recommendations

Enable verbose access logging on all WordPress endpoints handling VNPAY plugin shortcodes
Alert on any request containing HTML tag characters within query parameters on WooCommerce checkout completion routes
Monitor administrator session anomalies such as new plugin installations or user role changes following link clicks

How to Mitigate CVE-2025-12017

Immediate Actions Required

Disable or remove the VNPAY Payment gateway plugin until the vendor publishes a patched release
Audit WordPress administrator accounts for unauthorized changes and rotate credentials for any account that may have clicked a suspicious link
Deploy WAF signatures blocking XSS payloads on the message parameter

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. All versions up to and including 1.0.0 remain vulnerable. Site owners should monitor the plugin listing on WordPress.org and the Wordfence Vulnerability Report for an official update.

Workarounds

Apply a WAF rule that strips or blocks HTML metacharacters in the message query parameter for routes served by the plugin
Restrict WordPress admin panel access to trusted IP addresses to reduce the risk of admin-targeted phishing exploitation
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to limit the impact of reflected payloads

bash

# Example nginx rule to block script payloads in the message parameter
if ($arg_message ~* "(<|%3C)script|javascript:|onerror=") {
    return 403;
}