CVE-2025-12096: Simple Excel Pricelist XSS Vulnerability

CVE-2025-12096 Overview

CVE-2025-12096 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Excel Pricelist for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.13. It resides in the pricelist shortcode, which fails to sanitize user-supplied attributes and does not escape them on output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, enabling session theft, forced administrative actions, and content manipulation. The vulnerability is tracked under CWE-79.

Critical Impact
Contributor-level accounts can persist JavaScript that runs against site visitors and administrators, enabling account takeover and privilege escalation within WordPress environments.

Affected Products

Simple Excel Pricelist for WooCommerce plugin for WordPress
All versions up to and including 1.13
WordPress sites that expose the pricelist shortcode to Contributor-or-higher users

Discovery Timeline

2025-10-24 - CVE-2025-12096 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12096

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting issue triggered through the pricelist shortcode exposed by the plugin. WordPress shortcodes accept attributes that authors and contributors can supply from the post editor. In this plugin, those attributes flow into rendered HTML without being sanitized on input or escaped on output. Because the payload persists in post content, every visitor to the affected page executes the injected script under the site origin. That execution can steal authentication cookies, submit privileged requests through the WordPress REST API, or rewrite the DOM to phish credentials. The relevant code path is visible in the plugin source at line 176 of sepwWorker.php. Additional analysis is available in the Wordfence vulnerability report.

Root Cause

The plugin passes shortcode attributes directly into HTML output without invoking WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses(). There is also no allow-list validation on the attribute values. This absence of both input sanitization and output escaping is the classic pattern behind [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker first obtains a WordPress account with Contributor privileges or above. WordPress installations that permit self-registration at the Contributor level lower this barrier considerably. The attacker then creates or edits a post that includes the pricelist shortcode with a malicious attribute containing JavaScript. When any user views the resulting page, the browser parses the unescaped attribute and executes the payload in the context of the WordPress site.

No verified proof-of-concept code is published in the referenced advisories. Refer to the linked Wordfence report and plugin source for reproduction details.

Detection Methods for CVE-2025-12096

Indicators of Compromise

Post or page content containing the [pricelist] shortcode with attributes holding <script>, javascript:, or event handler strings such as onerror= and onload=
Unexpected Contributor or Author accounts created shortly before shortcode edits
Outbound browser requests from site visitors to attacker-controlled domains referenced from affected pages
WordPress audit log entries showing post edits that add or modify pricelist shortcode attributes

Detection Strategies

Query the wp_posts table for post_content matching the pricelist shortcode combined with HTML event handlers or script tags
Deploy a Web Application Firewall rule that flags shortcode attribute values containing HTML control characters
Compare the installed plugin version against 1.13 across all managed WordPress sites and flag any at or below that version

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and alert on shortcode edits by Contributor accounts
Monitor browser Content Security Policy violation reports for inline script execution on pages that render the pricelist shortcode
Track new user registrations at the Contributor role and correlate with subsequent post edits

How to Mitigate CVE-2025-12096

Immediate Actions Required

Update the Simple Excel Pricelist for WooCommerce plugin to a version newer than 1.13 once the vendor publishes a patched release
Audit existing posts and pages for the pricelist shortcode and inspect attribute values for injected script content
Review Contributor, Author, and Editor accounts for unfamiliar users and reset credentials where appropriate
Disable the plugin on affected sites until a fixed version is available if content authors cannot be fully trusted

Patch Information

At the time of NVD publication, all versions of the plugin up to and including 1.13 are affected. Administrators should consult the Wordfence vulnerability report and the plugin's WordPress.org listing for the current fixed version and update through the WordPress plugin manager or WP-CLI.

Workarounds

Restrict the Contributor role so that untrusted users cannot publish or edit posts containing shortcodes
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to a strict allow-list
Use a WordPress security plugin to virtually patch shortcode attribute handling until the vendor issues a fix
Remove the pricelist shortcode from published content and replace it with static pricing tables where feasible

bash

# Identify vulnerable installations and posts using WP-CLI
wp plugin list --name=simple-excel-pricelist-for-woocommerce --fields=name,status,version
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[pricelist%' AND post_status IN ('publish','draft','pending');"

# Update the plugin once a patched version is released
wp plugin update simple-excel-pricelist-for-woocommerce