CVE-2025-13369: WordPress Premmerce Plugin XSS Flaw

CVE-2025-13369 Overview

CVE-2025-13369 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Premmerce WooCommerce Customers Manager plugin for WordPress. The flaw affects all versions up to and including 1.1.14. The plugin fails to properly sanitize input and escape output for the money_spent_from, money_spent_to, registered_from, and registered_to parameters. Unauthenticated attackers can inject arbitrary JavaScript that executes in an administrator's browser when the administrator is tricked into clicking a crafted link. The vulnerability is tracked under [CWE-79] and assigned a CVSS score of 6.1.

Critical Impact
Successful exploitation allows arbitrary script execution in an administrator's session, enabling session hijacking, privileged action abuse, and persistence within the WordPress admin context.

Affected Products

Premmerce WooCommerce Customers Manager plugin for WordPress
All versions up to and including 1.1.14
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2026-01-07 - CVE-2025-13369 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13369

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the plugin's admin filter functionality. User-supplied values from the money_spent_from, money_spent_to, registered_from, and registered_to query parameters are reflected back into the admin filter view without sanitization or output escaping. An unauthenticated attacker can craft a URL containing JavaScript payloads in these parameters. When an authenticated administrator visits the crafted link, the payload renders in the admin interface and executes under the administrator's origin and session. Because the attack crosses a security scope from unauthenticated input to an authenticated admin context, the impact extends beyond the immediate page.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the plugin's admin code. Specifically, the parameter values processed in src/Admin/Admin.php and rendered in views/admin/filter.php are emitted into HTML without using WordPress escaping functions such as esc_attr() or esc_html(). See the WordPress plugin source for Admin.php and filter.php for the affected lines.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL targeting the plugin's admin filter endpoint with a script payload embedded in one of the four vulnerable parameters. The attacker delivers the link via phishing, forum posts, or other social engineering channels. When a WordPress administrator clicks the link while authenticated, the injected script executes in the admin's browser. The attacker can then exfiltrate session cookies, perform privileged actions through the WordPress REST API, create new administrator accounts, or pivot to plant a backdoor.

No verified proof-of-concept code is published. Refer to the Wordfence vulnerability report for additional technical details.

Detection Methods for CVE-2025-13369

Indicators of Compromise

Web server access logs containing requests with money_spent_from, money_spent_to, registered_from, or registered_to parameters carrying HTML or JavaScript characters such as <script>, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Referer headers from external domains pointing administrators to plugin admin pages.
Unexpected creation of WordPress administrator accounts or modification of user roles shortly after admin sessions.
Outbound requests from the WordPress server or admin browser to unknown domains following plugin page visits.

Detection Strategies

Inspect HTTP request logs for the four affected parameters and flag values containing angle brackets, quotes, or script keywords.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS payloads on the WooCommerce Customers Manager filter endpoint.
Hunt for anomalous admin actions correlated with recent visits to the plugin's filter pages.

Monitoring Recommendations

Monitor WordPress audit logs for new user creation, role changes, and plugin or theme installation events.
Alert on administrator browsers loading scripts from non-WordPress origins on admin pages.
Track plugin version inventory across WordPress installations to confirm patched releases are deployed.

How to Mitigate CVE-2025-13369

Immediate Actions Required

Update the Premmerce WooCommerce Customers Manager plugin to a version newer than 1.1.14 as soon as the vendor's fixed release is available, referencing changeset 3465273.
Restrict administrative access to the WordPress dashboard using IP allowlisting where feasible.
Train administrators to avoid clicking unsolicited links to WordPress admin URLs.

Patch Information

The vendor committed a fix referenced in WordPress plugin changeset 3465273. Site operators should upgrade to the latest plugin release published on the WordPress plugin repository. Verify the installed version under Plugins in the WordPress admin and confirm it is later than 1.1.14.

Workarounds

Deactivate and remove the Premmerce WooCommerce Customers Manager plugin until a patched version is installed.
Deploy WAF rules that strip or block <, >, and script tokens in the money_spent_from, money_spent_to, registered_from, and registered_to parameters.
Enforce a Content Security Policy (CSP) on the WordPress admin that disallows inline scripts and unauthorized origins.

bash

# Example ModSecurity rule to block XSS payloads on the affected parameters
SecRule ARGS:money_spent_from|ARGS:money_spent_to|ARGS:registered_from|ARGS:registered_to \
  "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1013369,phase:2,deny,status:403,log,msg:'CVE-2025-13369 XSS attempt blocked'"