CVE-2025-13137 Overview
CVE-2025-13137 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Live Sales Notification for WooCommerce – Woomotiv plugin for WordPress. The flaw affects all versions up to and including 3.6.3. It stems from insufficient input sanitization and output escaping on the woomotiv_limit parameter [CWE-79].
Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session theft, credential harvesting, or redirection to attacker-controlled infrastructure.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session after tricking the victim into clicking a malicious link, enabling account takeover of WordPress administrators.
Affected Products
- Live Sales Notification for WooCommerce – Woomotiv plugin for WordPress
- All plugin versions up to and including 3.6.3
- WordPress sites running WooCommerce with the Woomotiv extension enabled
Discovery Timeline
- 2025-12-06 - CVE-2025-13137 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13137
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting flaw in the Woomotiv plugin. The woomotiv_limit parameter is reflected into the rendered HTML response without adequate sanitization or output escaping. An attacker crafts a URL that includes JavaScript payloads in the woomotiv_limit value and delivers it to a victim through phishing, social engineering, or a malicious redirect.
When the victim loads the URL on the vulnerable site, the injected script executes in the security context of the WordPress origin. Because the attack traverses the browser's trusted origin boundary, exploitation impacts both confidentiality and integrity of session data. The scope change reflects the potential for the injected script to reach browser resources beyond the vulnerable component.
Exploitation requires user interaction but no authentication. A single click by an authenticated WordPress administrator can result in session hijack, forced administrative actions, or persistent backdoor installation via plugin editors.
Root Cause
The root cause is a missing input validation and output encoding pathway for the woomotiv_limit request parameter. The plugin accepts the parameter value and emits it back into HTML output without applying WordPress sanitization helpers such as esc_attr(), esc_html(), or sanitize_text_field(). This trust of untrusted input directly violates the guidance in CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
The attack is delivered over the network. An attacker constructs a URL pointing to the vulnerable endpoint with a malicious woomotiv_limit query value containing an XSS payload. The attacker sends the link to a target through email, chat, forum post, or embedded link. When the victim's browser renders the response, the injected script executes.
Typical payload objectives include stealing WordPress authentication cookies, invoking privileged REST endpoints via fetch(), or planting a rogue administrator account through the WordPress REST API. The vulnerability does not require the attacker to hold any account on the target site.
Refer to the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-13137
Indicators of Compromise
- HTTP requests containing the woomotiv_limit parameter with values including <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript
- Referer headers pointing to external phishing or link-shortener domains preceding requests to Woomotiv endpoints
- Unexpected creation of WordPress administrator accounts or modifications to wp_users following administrator link clicks
- Outbound requests from browser sessions to attacker-controlled hosts shortly after visiting a Woomotiv-enabled page
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that blocks or logs requests with script-like content in the woomotiv_limit query parameter
- Monitor WordPress access logs for anomalous query strings targeting Woomotiv endpoints, especially long or URL-encoded values
- Alert on WordPress audit events showing new admin user creation, plugin installation, or theme editor writes from unusual IP addresses
Monitoring Recommendations
- Ingest WordPress and reverse-proxy access logs into a centralized analytics platform and alert on payload signatures matching common XSS patterns
- Track browser telemetry for administrators, including Content Security Policy (CSP) violation reports from /wp-admin/
- Correlate authentication events with recent link clicks to identify suspected session hijack attempts
How to Mitigate CVE-2025-13137
Immediate Actions Required
- Update the Live Sales Notification for WooCommerce – Woomotiv plugin to a version later than 3.6.3 as soon as the vendor publishes a fixed release
- Deploy a WAF rule that blocks requests containing script-injection patterns in the woomotiv_limit parameter
- Rotate WordPress administrator passwords and invalidate active sessions if administrator click-through on suspicious links is suspected
- Enforce a strict Content Security Policy on the WordPress site to limit inline script execution
Patch Information
At the time of NVD publication, all versions up to and including 3.6.3 are affected. Site owners should monitor the official plugin page for a patched release and apply the update immediately when available. Verify the plugin version through the WordPress admin dashboard under Plugins after applying updates.
Workarounds
- Disable the Woomotiv plugin until a patched version is released if the plugin is not business-critical
- Restrict access to /wp-admin/ and Woomotiv endpoints by IP allowlist where operationally feasible
- Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin console
- Enable browser-based script isolation for administrators by using a dedicated browser profile for WordPress administration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
