CVE-2025-30898: Persian WooCommerce Shipping XSS Vulnerability

CVE-2025-30898 Overview

CVE-2025-30898 is a stored Cross-Site Scripting (XSS) vulnerability in the Persian WooCommerce Shipping plugin (persian-woocommerce-shipping) developed by Mahdi Yousefi. The flaw affects all plugin versions from initial release through 4.2.3. An authenticated attacker with low privileges can inject persistent malicious scripts into WordPress pages. When another user views the affected page, the payload executes in their browser session, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure. The vulnerability maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can store JavaScript payloads that execute in administrator browsers, enabling session hijacking and privilege escalation in WooCommerce stores using this plugin.

Affected Products

Persian WooCommerce Shipping plugin (persian-woocommerce-shipping) versions up to and including 4.2.3
WordPress installations with WooCommerce and this shipping plugin enabled
Iranian e-commerce sites using Persian postal integration through this plugin

Discovery Timeline

2025-03-27 - CVE-2025-30898 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30898

Vulnerability Analysis

The vulnerability resides in input handling routines within the Persian WooCommerce Shipping plugin. User-supplied data is written to plugin-controlled output without sufficient contextual encoding or sanitization. The stored nature of the flaw means the payload persists in the WordPress database and executes each time a victim renders the affected view. Because the vulnerability crosses a trust boundary (scope changed), a lower-privileged actor can affect higher-privileged users such as store administrators.

Root Cause

The root cause is missing or incomplete output escaping when rendering user-controlled fields associated with the plugin's shipping configuration or order metadata. WordPress provides escaping helpers such as esc_html(), esc_attr(), and wp_kses_post(), but the vulnerable code paths render input directly into HTML contexts. This allows <script> tags and event-handler attributes to survive to the browser.

Attack Vector

Exploitation requires an authenticated account with low privileges and user interaction from a victim who visits the poisoned page. The attacker submits a crafted payload through a plugin input field that stores its value in the database. The payload is later rendered without neutralization, causing script execution under the victim's origin. Refer to the Patchstack WordPress XSS Vulnerability advisory for context on the affected input surfaces.

// No verified proof-of-concept code is publicly available.
// See the Patchstack advisory for technical details on affected fields.

Detection Methods for CVE-2025-30898

Indicators of Compromise

WordPress postmeta or plugin option entries containing <script>, onerror=, or javascript: tokens tied to shipping fields
Unexpected outbound requests from administrator browsers to unfamiliar domains after visiting order or shipping pages
New administrator accounts or modified user roles following interaction with shipping-related admin views
Web server access logs showing POST requests to plugin endpoints with encoded HTML tags in parameter values

Detection Strategies

Query the WordPress database for shipping-related metadata containing HTML or JavaScript syntax
Deploy a web application firewall rule that blocks script tags and event handlers in requests targeting persian-woocommerce-shipping endpoints
Enable a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on WooCommerce admin pages

Monitoring Recommendations

Log and alert on WordPress user role changes, plugin installations, and option updates in real time
Monitor administrator session activity for anomalous API calls originating shortly after viewing order or shipping views
Track file integrity of WordPress core, WooCommerce, and installed plugins to detect follow-on tampering

How to Mitigate CVE-2025-30898

Immediate Actions Required

Update the Persian WooCommerce Shipping plugin to a version later than 4.2.3 as soon as a fixed release is available from the vendor
Audit existing shipping-related database entries for stored payloads and remove any injected HTML or JavaScript
Rotate WordPress administrator credentials and invalidate active sessions if the plugin has been in use on public-facing stores
Restrict low-privileged accounts that do not require access to shipping configuration

Patch Information

Refer to the Patchstack advisory for the current patch status and update instructions. Versions through 4.2.3 are confirmed vulnerable. Apply the vendor-supplied fix through the WordPress plugin manager once available.

Workarounds

Disable the persian-woocommerce-shipping plugin until a patched version is installed
Deploy a WAF rule that filters script tags, event handlers, and javascript: URIs in POST requests to plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Limit plugin administration to a small set of trusted accounts protected by multi-factor authentication

bash

# Temporarily deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate persian-woocommerce-shipping

# Verify plugin status
wp plugin status persian-woocommerce-shipping