CVE-2025-12123: WooCommerce Reviews Collector XSS Flaw

CVE-2025-12123 Overview

CVE-2025-12123 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Customer Reviews Collector for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 4.6.1. Attackers can inject arbitrary web scripts through the email-text parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can exploit the issue when a targeted user clicks a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account compromise on affected WooCommerce stores.

Affected Products

Customer Reviews Collector for WooCommerce plugin for WordPress
All versions up to and including 4.6.1
WooCommerce-enabled WordPress sites using the vulnerable plugin

Discovery Timeline

2025-11-27 - CVE-2025-12123 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12123

Vulnerability Analysis

The Customer Reviews Collector for WooCommerce plugin fails to sanitize input received through the email-text parameter. It also fails to escape output before rendering the parameter value back into the response page. This combination produces a Reflected XSS condition classified under CWE-79.

An attacker crafts a URL that includes malicious JavaScript in the email-text parameter. When a victim clicks the link, the plugin reflects the payload into the HTML response and the browser executes it in the context of the target site. Because the attack requires user interaction, exploitation depends on social engineering vectors such as phishing emails, malicious advertisements, or attacker-controlled referrers.

The scope change indicated in the CVSS vector means executed scripts can affect resources beyond the vulnerable component. Impact includes theft of authentication cookies, forced administrative actions, and delivery of secondary payloads to store administrators.

Root Cause

The root cause is missing input sanitization on the email-text request parameter combined with missing output escaping when the value is written back into the response. The plugin trusts user-supplied input and reflects it directly into HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

Exploitation is network-based and requires user interaction. An attacker delivers a crafted URL targeting a WordPress site running the vulnerable plugin. The URL contains a JavaScript payload in the email-text query parameter. When an authenticated administrator or logged-in customer follows the link, the injected script executes with the privileges of that user's session. See the Wordfence Vulnerability Report for additional technical context. No verified public exploit code is available. The vulnerability description confirms the flaw without providing sanitized proof-of-concept code.

Detection Methods for CVE-2025-12123

Indicators of Compromise

HTTP requests containing email-text parameters with embedded <script>, javascript:, or event handler payloads such as onerror= and onload=
Referrer headers from unfamiliar or attacker-controlled domains directing users to plugin endpoints
Unexpected outbound requests from administrator browsers to unknown domains shortly after clicking email or chat links
New unauthorized WordPress administrator accounts or modified user privileges following a suspicious link click

Detection Strategies

Inspect web server access logs for query strings containing HTML tags, script keywords, or URL-encoded angle brackets in the email-text parameter
Deploy web application firewall (WAF) rules that flag reflected XSS patterns targeting WordPress plugin endpoints
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts

Monitoring Recommendations

Monitor WordPress audit logs for administrative actions immediately following external referrer traffic
Alert on plugin file modifications, new user creation, and unexpected option changes in wp_options
Track outbound network connections from browsers used by store administrators to identify data exfiltration attempts

How to Mitigate CVE-2025-12123

Immediate Actions Required

Update the Customer Reviews Collector for WooCommerce plugin to a version later than 4.6.1 as soon as the vendor publishes a fixed release
Audit WordPress administrator accounts and rotate credentials for any user who may have clicked suspicious links
Deploy a WAF rule blocking requests containing script tags or JavaScript event handlers in the email-text parameter

Patch Information

Refer to the WordPress Plugin Change Log for the vendor's remediation commits. Site administrators should apply the patched version through the WordPress plugin management interface once available. The Wordfence Vulnerability Report provides ongoing status updates.

Workarounds

Deactivate the Customer Reviews Collector for WooCommerce plugin until a patched version is installed
Implement a strict Content Security Policy that disallows inline script execution to reduce XSS impact
Restrict administrator access to the WordPress admin panel using IP allowlisting or VPN requirements
Educate administrators and staff to avoid clicking unsolicited links referencing store URLs or review collection workflows

bash

# Example WAF rule (ModSecurity) blocking script payloads in email-text parameter
SecRule ARGS:email-text "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1012123,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2025-12123 Reflected XSS attempt blocked',\
    tag:'CWE-79'"