CVE-2025-27275: WOO Codice Fiscale XSS Vulnerability

CVE-2025-27275 Overview

CVE-2025-27275 is a reflected Cross-Site Scripting (XSS) vulnerability in the WOO Codice Fiscale WordPress plugin developed by andrew_fisher. The flaw affects all versions of the plugin up to and including 1.6.3. Attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim follows a crafted link. The issue is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. Successful exploitation allows session theft, credential harvesting, and unauthorized actions performed in the context of the targeted WordPress user.

Critical Impact
Reflected XSS enables attackers to execute arbitrary JavaScript in an authenticated administrator's browser, potentially leading to site compromise.

Affected Products

WOO Codice Fiscale plugin (woo-codice-fiscale) versions through 1.6.3
WordPress installations running the vulnerable plugin
WooCommerce stores using the plugin for Italian tax code validation

Discovery Timeline

2025-03-03 - CVE-2025-27275 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27275

Vulnerability Analysis

The WOO Codice Fiscale plugin extends WooCommerce to handle the Italian Codice Fiscale tax identification code. The vulnerability arises because user-controlled input is reflected back into the rendered HTML response without proper sanitization or output encoding. An attacker crafts a URL containing JavaScript payloads in a vulnerable parameter. When a victim clicks the link, the server echoes the payload into the page, and the browser executes it within the site's origin.

Because the attack runs in the victim's session context, payloads can access cookies not marked HttpOnly, manipulate the DOM, submit authenticated requests, and pivot toward administrative actions if the victim holds elevated privileges.

Root Cause

The root cause is missing input neutralization on a request parameter that is later included in the HTML output. The plugin fails to apply WordPress sanitization and escaping primitives such as sanitize_text_field() on input and esc_html() or esc_attr() on output. This breaks the trust boundary between user-supplied data and the rendered page.

Attack Vector

Exploitation requires user interaction (UI:R) but no privileges (PR:N). The attacker delivers a crafted URL through phishing, social media, or a malicious referrer. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component, including other plugins and the WordPress admin context. No verified proof-of-concept code is publicly indexed; refer to the Patchstack XSS Vulnerability Report for technical details.

Detection Methods for CVE-2025-27275

Indicators of Compromise

Inbound HTTP requests to WordPress endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: payloads
Referrer logs showing external sources directing users to plugin endpoints with unusual query strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links

Detection Strategies

Inspect web server access logs for query parameters containing HTML or JavaScript metacharacters targeting woo-codice-fiscale paths
Deploy a Web Application Firewall (WAF) rule set covering OWASP CRS XSS signatures and monitor blocked requests
Use Content Security Policy (CSP) violation reports to surface inline script execution attempts on WooCommerce pages

Monitoring Recommendations

Enable WordPress audit logging to track plugin and administrator actions following suspicious link clicks
Correlate authentication anomalies, such as session reuse from new IP addresses, with recent administrator browsing activity
Alert on outbound DNS queries from admin workstations to newly registered or low-reputation domains

How to Mitigate CVE-2025-27275

Immediate Actions Required

Identify all WordPress instances running woo-codice-fiscale version 1.6.3 or earlier
Disable or remove the plugin until a patched version is confirmed installed
Force a logout of all administrative sessions and rotate WordPress credentials and API keys

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the Patchstack advisory and the official WordPress plugin repository for an update beyond version 1.6.3 and apply it immediately upon release.

Workarounds

Deploy WAF rules that block reflected XSS payloads targeting plugin endpoints
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources
Restrict administrator access to known IP ranges and require multi-factor authentication for the WordPress admin panel
Train administrators to avoid clicking unsolicited links that reference the WordPress site

bash

# Example nginx CSP header to mitigate reflected XSS impact
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self';" always;