CVE-2025-30906: Getnet WooCommerce Plugin XSS Vulnerability

CVE-2025-30906 Overview

CVE-2025-30906 is a reflected Cross-Site Scripting (XSS) vulnerability in the Plugin Oficial – Getnet para WooCommerce WordPress plugin developed by lisandragetnet. The flaw affects all plugin versions up to and including 1.7.3 and stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when visited by an authenticated or unauthenticated victim, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and operates across a network attack vector with a changed scope, allowing the injected script to affect resources beyond the vulnerable component.

Critical Impact

Reflected XSS in a WooCommerce checkout integration plugin enables session hijacking, credential theft, and unauthorized actions performed in the context of victim users, including store administrators.

Affected Products

• Plugin Oficial – Getnet para WooCommerce (wc-checkout-getnet) versions through 1.7.3
• WordPress sites running the affected plugin with WooCommerce checkout enabled
• Administrative and customer sessions on sites where the plugin is active

Discovery Timeline

• 2025-04-01 - CVE-2025-30906 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30906

Vulnerability Analysis

The vulnerability resides in the wc-checkout-getnet plugin, which integrates the Getnet payment gateway with WooCommerce. The plugin reflects user-supplied input back into HTTP responses without applying proper output encoding or sanitization. An attacker constructs a URL containing JavaScript payloads in request parameters processed by the plugin. When a victim clicks the crafted link, the unsanitized payload renders inside the response HTML and executes in the browser.

The reflected XSS variant differs from stored XSS because the payload is not persisted on the server. Exploitation depends on social engineering to deliver the malicious URL, typically through phishing emails, messaging platforms, or attacker-controlled web pages. The CVSS scope change indicates that successful exploitation impacts resources beyond the vulnerable plugin, such as the broader WordPress administrative interface.

Root Cause

The root cause is missing input validation and output escaping in the plugin's request handlers. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output, but the affected code paths in wc-checkout-getnet fail to apply them before echoing parameters into HTML responses.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing to the vulnerable WordPress endpoint with an embedded JavaScript payload. After the victim opens the link, the script executes with access to cookies, session tokens, and the DOM. Attackers can exfiltrate authentication cookies, perform actions on behalf of the victim, or pivot to administrative functions if an administrator is targeted. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30906

Indicators of Compromise

• HTTP requests to wc-checkout-getnet plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: strings
• Web server access logs showing unusual query parameters with HTML entities or hex-encoded JavaScript
• Outbound browser requests to attacker-controlled domains immediately following checkout page visits
• Unexpected administrative actions originating from legitimate user sessions

Detection Strategies

• Inspect WordPress and reverse proxy access logs for query strings containing script tags or event handlers targeting the Getnet plugin paths
• Deploy a Web Application Firewall (WAF) ruleset that flags reflected XSS patterns in requests to /wp-content/plugins/wc-checkout-getnet/
• Monitor browser security telemetry for Content Security Policy (CSP) violations originating from WooCommerce checkout pages

Monitoring Recommendations

• Enable verbose HTTP request logging on WordPress sites running WooCommerce with Getnet integration
• Correlate referrer headers with suspicious query parameters to identify phishing campaigns delivering crafted URLs
• Alert on administrator account activity that immediately follows the loading of plugin-controlled checkout endpoints

How to Mitigate CVE-2025-30906

Immediate Actions Required

• Identify all WordPress instances running Plugin Oficial – Getnet para WooCommerce version 1.7.3 or earlier
• Update the plugin to a patched version released after 1.7.3 once available from the vendor
• Invalidate active administrator sessions and rotate credentials if exploitation is suspected
• Review WooCommerce order and user activity logs for unauthorized actions

Patch Information

No fixed version is referenced in the public advisory at the time of NVD publication. Monitor the Patchstack Vulnerability Report and the plugin repository for an updated release addressing CVE-2025-30906.

Workarounds

• Disable or remove the wc-checkout-getnet plugin until a patched version is installed
• Deploy WAF rules that block requests containing reflected XSS payloads targeting plugin endpoints
• Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WooCommerce checkout pages
• Restrict administrative interface access by source IP address to reduce the impact of session hijacking