CVE-2025-30857: WooCommerce Currency Switcher CSRF Vulnerability

CVE-2025-30857 Overview

CVE-2025-30857 is a Cross-Site Request Forgery (CSRF) vulnerability in the PressMaximum Currency Switcher for WooCommerce WordPress plugin that enables attackers to perform Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability allows malicious actors to trick authenticated administrators into unknowingly submitting requests that inject persistent malicious scripts into the WordPress installation.

Critical Impact

This CSRF to Stored XSS chain allows attackers to persistently inject malicious JavaScript code into the WordPress site, potentially compromising all site visitors and administrators through session hijacking, credential theft, or malware distribution.

Affected Products

• Currency Switcher for WooCommerce plugin versions up to and including 0.0.7
• WordPress installations using the currency-switcher-for-woocommerce plugin
• WooCommerce stores utilizing the affected plugin for currency conversion functionality

Discovery Timeline

• 2025-03-27 - CVE CVE-2025-30857 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30857

Vulnerability Analysis

This vulnerability represents a dangerous attack chain combining two web application security weaknesses. The plugin lacks proper CSRF token validation on administrative forms that handle currency configuration settings. When combined with insufficient output encoding, attackers can exploit this weakness to inject malicious JavaScript code that persists in the database and executes whenever the affected page is rendered.

The attack requires social engineering to lure an authenticated administrator to a malicious page containing a crafted form submission. Once triggered, the malicious payload becomes stored in the WordPress database and executes in the browser context of any user viewing the affected content.

Root Cause

The root cause of this vulnerability lies in the absence of nonce verification in the plugin's form handling functions. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to prevent CSRF attacks, but the Currency Switcher for WooCommerce plugin fails to implement these security controls. Additionally, user-supplied input is stored and subsequently rendered without proper sanitization using functions like esc_html() or esc_attr(), enabling the Stored XSS component of the attack.

Attack Vector

The attack unfolds in multiple stages. First, an attacker crafts a malicious HTML page containing a hidden form that targets the vulnerable plugin endpoint. This form includes XSS payloads in the currency configuration fields. When an authenticated WordPress administrator visits the attacker-controlled page, the form automatically submits to the vulnerable endpoint using the administrator's session cookies. The malicious JavaScript payload is then stored in the database. Subsequently, any user or administrator who views pages utilizing the currency switcher functionality will have the malicious script execute in their browser.

This vulnerability does not require authentication for the attacker, but does require interaction from an authenticated administrator to trigger the initial CSRF exploit. The stored nature of the XSS means the impact persists and affects all subsequent visitors.

Detection Methods for CVE-2025-30857

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in currency switcher configuration fields
• Suspicious outbound requests from administrator browsers to unknown external domains
• Unusual administrative changes to plugin settings without corresponding audit log entries
• Reports of browser warnings or unexpected redirects from WooCommerce store pages

Detection Strategies

• Review WordPress database tables for unexpected HTML or JavaScript content in currency-related option values
• Monitor HTTP access logs for POST requests to plugin endpoints from external referrers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to detect XSS payloads in form submissions

Monitoring Recommendations

• Enable WordPress audit logging to track all plugin configuration changes with timestamps and user attribution
• Configure browser-based XSS auditor alerts through security headers
• Implement real-time monitoring for database modifications to plugin option tables
• Set up alerts for administrator sessions that submit forms with unexpected referrer headers

How to Mitigate CVE-2025-30857

Immediate Actions Required

• Deactivate and remove the Currency Switcher for WooCommerce plugin until a patched version is available
• Audit existing currency switcher settings for any injected malicious content
• Review WordPress administrator accounts for any signs of compromise
• Implement Content Security Policy headers to mitigate XSS impact as a defense-in-depth measure

Patch Information

No official patch has been confirmed at the time of this advisory. Organizations should monitor the Patchstack Vulnerability Advisory for updates regarding a security fix from the plugin developer. Consider migrating to an alternative currency switching solution that has undergone security review.

Workarounds

• Remove the affected plugin entirely and replace with a security-audited alternative
• Restrict WordPress administrative access to trusted IP addresses only
• Implement additional authentication factors for WordPress administrator accounts
• Deploy a web application firewall with CSRF and XSS protection rules enabled

# WordPress configuration hardening example
# Add to wp-config.php or .htaccess

# Restrict admin access by IP (example for .htaccess)
# <Files wp-admin>
#   Order deny,allow
#   Deny from all
#   Allow from YOUR_TRUSTED_IP
# </Files>

# Add security headers via functions.php
# add_action('send_headers', function() {
#   header("Content-Security-Policy: default-src 'self'; script-src 'self'");
#   header("X-Content-Type-Options: nosniff");
#   header("X-Frame-Options: SAMEORIGIN");
# });