CVE-2025-23966: Pasargad Bank WooCommerce Gateway XSS Flaw

CVE-2025-23966 Overview

CVE-2025-23966 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the a-gateway-for-pasargad-bank-on-woocommerce WordPress plugin developed by Ala Falaki. The flaw exists in all versions up to and including 2.5.2. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in the victim's browser. Exploitation requires user interaction, typically by tricking a target into clicking a crafted link. Successful attacks can lead to session theft, credential harvesting, and unauthorized actions performed under the victim's authenticated session. The issue is tracked under CWE-79.

Critical Impact

Attackers can execute arbitrary JavaScript in the browser of any user who visits a crafted URL, potentially compromising WooCommerce store administrators and customers.

Affected Products

• Ala Falaki — a Gateway for Pasargad Bank on WooCommerce plugin (versions up to and including 2.5.2)
• WordPress sites running WooCommerce with the affected payment gateway plugin installed
• All deployments that have not upgraded beyond version 2.5.2

Discovery Timeline

• 2025-01-22 - CVE-2025-23966 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23966

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Pasargad Bank payment gateway plugin for WooCommerce. The plugin accepts input from HTTP request parameters and embeds the data directly into the generated HTML response without proper escaping or sanitization. When a victim clicks a crafted link, the malicious payload reflects back into the rendered page and executes in the browser context of the targeted user.

The attack operates over the network with low complexity and requires no authentication. User interaction is required because the victim must visit the attacker-controlled URL. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component, including the WordPress administrative interface if an authenticated administrator is targeted. The EPSS probability of 0.178% reflects current observed exploitation activity, though reflected XSS in WooCommerce extensions remains a common target for opportunistic campaigns.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. The plugin reads request parameters and writes them into HTML output without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows an attacker to break out of the intended HTML context and inject executable JavaScript.

Attack Vector

An attacker crafts a URL pointing to a vulnerable endpoint of the plugin, embedding a JavaScript payload inside a reflected parameter. The attacker then delivers the link through phishing email, social media, or a malicious third-party site. When the target clicks the link, the browser executes the injected script under the origin of the WooCommerce site. Possible outcomes include cookie theft, session token exfiltration, fraudulent admin actions, and redirection to attacker-controlled phishing pages designed to capture banking credentials.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-23966

Indicators of Compromise

• HTTP requests to plugin endpoints containing reflected parameters with <script>, javascript:, onerror=, or onload= substrings
• URL parameters containing encoded payloads such as %3Cscript%3E or %3Cimg directed at the plugin path
• Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after visiting WooCommerce admin pages
• New or modified WordPress administrator accounts created without a corresponding authenticated admin workflow

Detection Strategies

• Inspect web server access logs for query string patterns containing HTML tags or JavaScript event handlers targeted at the a-gateway-for-pasargad-bank-on-woocommerce plugin paths
• Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS signatures on WordPress plugin endpoints
• Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution attempts
• Correlate referrer headers from external sources with administrator session activity to identify phishing-driven access

Monitoring Recommendations

• Enable verbose HTTP logging on WordPress front-end servers and retain logs for at least 90 days
• Alert on any HTTP 200 responses where the response body reflects raw query string values to clients
• Track plugin version inventories across managed WordPress estates and flag installations at version 2.5.2 or earlier

How to Mitigate CVE-2025-23966

Immediate Actions Required

• Identify all WordPress sites running the a-gateway-for-pasargad-bank-on-woocommerce plugin and confirm installed version
• Update the plugin to a version newer than 2.5.2 once the vendor publishes a fix, or remove the plugin if no patch is available
• Force a session refresh and password reset for WordPress administrators who may have visited untrusted links recently
• Review WooCommerce order logs and admin audit trails for unauthorized changes

Patch Information

At the time of publication, the vendor advisory referenced in the Patchstack Vulnerability Report indicates the issue affects all versions up to and including 2.5.2. Administrators should monitor the WordPress plugin repository for an updated release and apply the patched version as soon as it becomes available.

Workarounds

• Deactivate and remove the plugin until a patched version is released if Pasargad Bank payment processing is not actively required
• Deploy a WAF rule that blocks requests containing script tags or JavaScript event handlers in query parameters targeting plugin endpoints
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Train administrators to avoid clicking unsolicited links to the WooCommerce admin interface and to access the admin panel only from trusted bookmarks

# Example WAF rule (ModSecurity) to block reflected XSS payloads on the affected plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/a-gateway-for-pasargad-bank-on-woocommerce/" \
  "chain,phase:2,deny,status:403,id:1002025,log,msg:'Potential XSS targeting CVE-2025-23966'"
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|<img[^>]+src)" \
  "t:none,t:urlDecodeUni"