CVE-2025-13974: WooCommerce Email Customizer XSS Flaw

CVE-2025-13974 Overview

CVE-2025-13974 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Email Customizer for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 2.6.7 due to insufficient input sanitization and output escaping in email template content. This security flaw allows authenticated attackers with administrator-level access to inject arbitrary web scripts into email templates that execute when customers view transactional emails.

Critical Impact

Attackers can inject malicious scripts into WooCommerce transactional emails that execute in customers' browsers, potentially leading to session hijacking, credential theft, or malware distribution through trusted email communications.

Affected Products

• Email Customizer for WooCommerce plugin for WordPress versions up to and including 2.6.7
• WordPress multi-site installations
• WordPress installations where unfiltered_html has been disabled

Discovery Timeline

• 2026-01-07 - CVE-2025-13974 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13974

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) resides in the email template handling functionality of the Email Customizer for WooCommerce plugin. The vulnerability stems from the plugin's failure to properly sanitize user-supplied input and escape output when processing email template content.

The attack requires administrator-level privileges to exploit, which limits the attack surface. However, the impact is magnified because the injected scripts execute within the context of transactional emails viewed by customers. This creates a trust exploitation scenario where malicious content appears to originate from legitimate WooCommerce order communications.

The vulnerability specifically affects WordPress multi-site installations and single-site installations where the unfiltered_html capability has been explicitly disabled. In standard single-site WordPress installations with default configurations, administrators already have the unfiltered_html capability, making this vulnerability less impactful in those environments.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the class-wecmf-general-template.php file at line 213. When email template content is processed, the plugin fails to properly filter or encode potentially dangerous HTML and JavaScript content before rendering it in customer-facing emails. This allows script tags and other executable content to be stored in the database and later rendered without proper escaping.

Attack Vector

The attack vector is network-based and requires high privileges (administrator access) to execute. An attacker with compromised administrator credentials or a malicious insider could:

1. Access the WordPress admin dashboard with administrator privileges
2. Navigate to the Email Customizer for WooCommerce settings
3. Inject malicious JavaScript code into email template fields
4. The malicious script is stored in the database
5. When customers receive transactional emails (order confirmations, shipping notifications, etc.), the injected scripts execute in their email client or browser

The vulnerable code can be examined in the WordPress Plugin Code Reference. The vulnerability manifests when email template content containing script elements is rendered without proper output encoding. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-13974

Indicators of Compromise

• Unusual JavaScript code or <script> tags present in WooCommerce email template configurations
• Customer reports of suspicious behavior when viewing transactional emails
• Unexpected external resource requests originating from email content
• Modified email template entries in the WordPress database with encoded or obfuscated script content

Detection Strategies

• Review WooCommerce email template configurations for any unauthorized modifications or suspicious script injections
• Implement file integrity monitoring on the class-wecmf-general-template.php file and related plugin files
• Monitor WordPress admin activity logs for unauthorized changes to email customizer settings
• Audit database entries related to email templates for signs of injected malicious content

Monitoring Recommendations

• Enable detailed WordPress audit logging for all administrative actions, particularly plugin configuration changes
• Configure web application firewall (WAF) rules to detect XSS payloads in POST requests to email customizer endpoints
• Implement Content Security Policy (CSP) headers to mitigate the impact of any successful script injection
• Regularly review email template content for unauthorized modifications

How to Mitigate CVE-2025-13974

Immediate Actions Required

• Update the Email Customizer for WooCommerce plugin to a version newer than 2.6.7 when a patch becomes available
• Audit all existing email templates for signs of malicious script injection
• Review administrator account access and enforce strong authentication practices including multi-factor authentication
• Temporarily restrict access to email customizer functionality to trusted administrators only

Patch Information

Organizations should monitor the official WordPress plugin repository for an updated version of the Email Customizer for WooCommerce plugin that addresses this vulnerability. The vulnerable code is located in classes/inc/class-wecmf-general-template.php at line 213. When a patched version is released, update immediately through the WordPress admin dashboard or via WP-CLI.

For technical reference on the affected code, see the WordPress Plugin Code Reference.

Workarounds

• Limit administrator account access to only essential personnel and implement the principle of least privilege
• Enable unfiltered_html restrictions on single-site installations where this capability is currently allowed
• Implement additional server-side input validation through a web application firewall (WAF) to filter XSS payloads
• Consider temporarily disabling the Email Customizer for WooCommerce plugin until a patched version is available

# Configuration example - Disable unfiltered_html capability for administrators
# Add to wp-config.php to restrict HTML capabilities
define('DISALLOW_UNFILTERED_HTML', true);

# Alternative: Use WP-CLI to audit plugin status
wp plugin list --fields=name,status,version | grep email-customizer

# Check for plugin updates
wp plugin update email-customizer-for-woocommerce --dry-run