CVE-2025-22632: WooCommerce Pricing Table Stored XSS Flaw

CVE-2025-22632 Overview

CVE-2025-22632 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce Pricing – Product Pricing plugin (woo-pricing-table) developed by totalsoft for WordPress. This vulnerability allows attackers to inject malicious scripts that are persistently stored on the target server, executing whenever users view affected pages.

Critical Impact

Attackers can inject persistent malicious scripts into WooCommerce pricing tables, potentially stealing user credentials, session tokens, or performing actions on behalf of authenticated administrators.

Affected Products

• WooCommerce Pricing – Product Pricing plugin version 1.0.9 and earlier
• WordPress sites using the woo-pricing-table plugin
• WooCommerce stores with pricing table functionality enabled

Discovery Timeline

• 2025-02-23 - CVE CVE-2025-22632 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22632

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) stems from improper neutralization of user-supplied input during web page generation within the WooCommerce Pricing – Product Pricing plugin. The vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads that are stored in the WordPress database and subsequently rendered to all users viewing the affected pricing tables.

The attack requires user interaction, as victims must navigate to a page containing the malicious payload. However, once triggered, the injected scripts execute within the context of the victim's browser session, potentially compromising administrative accounts or sensitive customer data on WooCommerce stores.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output encoding within the plugin's pricing table functionality. User-controlled data is accepted and stored without proper validation, then rendered directly into HTML pages without adequate escaping. This allows specially crafted input containing JavaScript to be interpreted as executable code by browsers rather than displayed as plain text.

Attack Vector

The attack vector is network-based, requiring an attacker to submit malicious input through the plugin's interface. The exploitation chain typically involves:

1. An attacker identifies input fields within the WooCommerce Pricing plugin that accept and store user data
2. Malicious JavaScript payload is crafted and submitted through these input fields
3. The payload is stored in the WordPress database without proper sanitization
4. When legitimate users (including administrators) view pages containing the pricing table, the malicious script executes
5. The script can steal session cookies, perform CSRF attacks, redirect users to phishing pages, or modify page content

For detailed technical analysis, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-22632

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in pricing table content or database entries
• Unusual outbound connections from client browsers when viewing WooCommerce pricing pages
• Reports of users being redirected to external domains when accessing product pricing pages
• Suspicious entries in WordPress database tables related to the woo-pricing-table plugin

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in HTTP requests targeting WordPress plugins
• Monitor WordPress database for suspicious HTML/JavaScript content in plugin-related tables
• Deploy browser-based Content Security Policy (CSP) headers to restrict inline script execution
• Regularly scan WordPress installations using security plugins that detect stored XSS patterns

Monitoring Recommendations

• Enable detailed logging for all WordPress plugin activity and review logs for suspicious input patterns
• Configure alerts for any modifications to pricing table content or plugin settings
• Monitor client-side JavaScript errors that may indicate blocked XSS attempts via CSP
• Implement real-time file integrity monitoring for plugin files to detect unauthorized modifications

How to Mitigate CVE-2025-22632

Immediate Actions Required

• Update the WooCommerce Pricing – Product Pricing plugin to a patched version when available from totalsoft
• Review all existing pricing table content for suspicious JavaScript or HTML injections
• Implement Content Security Policy headers to mitigate the impact of any existing XSS payloads
• Consider temporarily disabling the plugin until a security patch is released

Patch Information

Organizations should monitor the official WordPress plugin repository and the Patchstack Vulnerability Report for updates regarding a patched version of WooCommerce Pricing – Product Pricing. All versions through 1.0.9 are confirmed vulnerable.

Workarounds

• Implement strict Content Security Policy headers to prevent inline script execution
• Deploy a Web Application Firewall with XSS detection rules specific to WordPress environments
• Restrict access to plugin administrative functions to trusted IP addresses only
• Regularly audit and sanitize all stored content within the pricing table database entries

# Example CSP header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"