CVE-2025-22622: Age Verification Checkout XSS Vulnerability

CVE-2025-22622 Overview

CVE-2025-22622 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Age Verification for your checkout page. Verify your customer's identity" version 1.20.0. The plugin generates web content dynamically without validating the source of potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php. Attackers can inject script content that executes in the context of a victim's browser session when the user interacts with a crafted link. The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
An attacker can execute arbitrary JavaScript in the browser of a targeted user, enabling session token theft, defacement, or redirection to attacker-controlled infrastructure on WooCommerce checkout pages.

Affected Products

WordPress plugin: Age Verification for your checkout page (agecheckernet)
Affected version: 1.20.0
Deployment context: WooCommerce integration on WordPress sites

Discovery Timeline

2025-02-19 - CVE-2025-22622 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22622

Vulnerability Analysis

The plugin file myapp/class-wc-integration-agechecker-integration.php renders request-derived values into HTML responses without applying context-appropriate output encoding or input validation. An attacker crafts a URL containing malicious JavaScript in a parameter that the plugin reflects into the checkout page markup. When a logged-in shopper or administrator visits the crafted link, the browser parses the injected payload as executable script.

Exploitation requires user interaction, and the impact is scoped to integrity of the rendered page. The attacker cannot directly read confidential server data through the flaw, but session cookies, form data, and DOM state accessible to the executing script are exposed. The EPSS probability of exploitation is 0.274%, placing the vulnerability in the 19th percentile.

Root Cause

The plugin fails to escape or sanitize untrusted request data before embedding it in HTML output. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses() for exactly this purpose, but the affected integration class does not apply them consistently. This omission is the classic pattern behind reflected XSS ([CWE-79]).

Attack Vector

The attacker delivers a crafted URL through phishing email, chat, social media, or a malicious page. The URL targets a checkout endpoint on a store that has the vulnerable plugin installed. When the victim clicks the link, the reflected payload executes with the origin of the store, enabling actions on behalf of the authenticated user.

No verified proof-of-concept code has been published. Refer to the Fluid Attacks Security Advisory for technical detail on the injection point.

Detection Methods for CVE-2025-22622

Indicators of Compromise

Web server access logs containing checkout URLs with encoded <script>, onerror=, or javascript: payloads in query parameters
Referrer headers pointing to unfamiliar external domains preceding checkout page visits
Unexpected outbound requests from browser sessions to attacker-controlled hosts shortly after checkout activity

Detection Strategies

Inspect HTTP request parameters delivered to WooCommerce checkout endpoints for HTML control characters and script tokens
Deploy a Web Application Firewall (WAF) rule that blocks common reflected XSS signatures on WordPress checkout routes
Audit installed plugin versions across WordPress estates and flag instances of agecheckernet at version 1.20.0 or earlier

Monitoring Recommendations

Alert on WordPress plugin file modifications to class-wc-integration-agechecker-integration.php
Enable a Content Security Policy (CSP) report-only header to surface unauthorized inline script execution attempts
Correlate administrator authentication events with checkout page traffic to identify suspicious session takeovers

How to Mitigate CVE-2025-22622

Immediate Actions Required

Identify all WordPress installations running the Age Verification plugin at version 1.20.0
Update the plugin to a version released after the advisory once the vendor publishes a fix, tracked via the WordPress Plugin Documentation
Restrict administrative and checkout access to trusted networks where operationally feasible

Patch Information

At the time of this writing, the Fluid Attacks Security Advisory documents the vulnerability in version 1.20.0. Site operators should monitor the plugin listing for a patched release and apply it as soon as it is available. Until then, treat the plugin as unpatched.

Workarounds

Deactivate and remove the Age Verification plugin from production sites until a fixed release is published
Deploy a WAF rule that blocks requests containing HTML or script metacharacters in query parameters bound for the checkout page
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Require reauthentication for administrative sessions to limit the impact of stolen cookies

bash

# Example WAF rule (ModSecurity) blocking reflected script payloads on checkout
SecRule REQUEST_URI "@contains /checkout" \
  "chain,phase:2,deny,status:403,id:1002201,\
  msg:'Potential reflected XSS targeting age verification plugin (CVE-2025-22622)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"