CVE-2025-30924: Primer MyData for Woocommerce XSS Flaw

CVE-2025-30924 Overview

CVE-2025-30924 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Primer MyData for WooCommerce WordPress plugin. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

The vulnerability enables attackers to craft malicious URLs containing JavaScript payloads. When an authenticated user clicks on such a link, the malicious script executes within their browser session, potentially leading to session hijacking, credential theft, or further attacks against the WordPress installation.

Critical Impact

Attackers can steal session cookies, perform actions on behalf of authenticated users, deface web pages, or redirect users to malicious sites through crafted URLs targeting the vulnerable plugin endpoints.

Affected Products

• Primer MyData for WooCommerce plugin versions prior to 4.2.4
• WordPress installations using vulnerable versions of the primer-mydata plugin
• WooCommerce stores with the Primer MyData integration enabled

Discovery Timeline

• 2025-04-01 - CVE-2025-30924 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30924

Vulnerability Analysis

This Reflected XSS vulnerability occurs when the Primer MyData for WooCommerce plugin fails to properly sanitize user-supplied input before reflecting it back in HTTP responses. The plugin does not adequately escape special characters in input parameters, allowing attackers to inject arbitrary HTML and JavaScript code.

When a victim visits a crafted URL containing a malicious payload, the server reflects the unsanitized input directly into the page response. The victim's browser then executes the injected script with the same privileges as the legitimate application, enabling various attack scenarios including session theft and phishing.

The attack requires user interaction—specifically, the victim must click on a malicious link. However, given the prevalence of social engineering techniques and the ability to disguise links, this requirement does not significantly diminish the risk. The scope is changed (S:C in CVSS), meaning the vulnerable component impacts resources beyond its security scope, potentially affecting the entire WordPress installation.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding within the Primer MyData for WooCommerce plugin. The application fails to implement proper security controls when handling user-supplied data, specifically:

1. Missing Input Sanitization: The plugin does not filter or sanitize potentially dangerous characters (such as <, >, ", ', and script tags) from user input
2. Inadequate Output Encoding: When reflecting user input in HTML responses, the plugin does not properly encode special characters to prevent them from being interpreted as HTML or JavaScript
3. Lack of Content Security Policy: The absence of restrictive CSP headers allows inline script execution

Attack Vector

The attack vector is network-based and requires minimal attacker privileges but depends on user interaction. An attacker typically exploits this vulnerability through the following steps:

1. The attacker identifies a vulnerable parameter in the Primer MyData plugin that reflects user input
2. The attacker crafts a malicious URL containing JavaScript payload embedded in the vulnerable parameter
3. The URL is distributed via phishing emails, social media, or embedded in compromised websites
4. When a victim (typically a WordPress administrator or shop manager) clicks the link, the malicious script executes in their browser context
5. The script can then steal session tokens, capture keystrokes, or perform actions on behalf of the authenticated user

The vulnerability affects the confidentiality, integrity, and availability of the application with low impact in each category, but the changed scope means the attack can extend beyond the vulnerable component to affect other resources.

Detection Methods for CVE-2025-30924

Indicators of Compromise

• Suspicious URL parameters containing encoded script tags or JavaScript event handlers in WordPress access logs
• Unusual referrer headers pointing to the vulnerable plugin endpoints with suspicious query strings
• Reports of unexpected redirects or pop-ups from users accessing the WordPress/WooCommerce site
• Unexpected session activity or administrative actions not performed by legitimate administrators

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common XSS patterns in request parameters targeting WordPress plugins
• Review access logs for requests containing suspicious characters such as <script>, onerror=, javascript:, or URL-encoded equivalents
• Deploy browser-based security controls that alert on XSS attempts
• Use automated vulnerability scanners to identify the presence of vulnerable plugin versions

Monitoring Recommendations

• Enable detailed logging for all WordPress plugin-related HTTP requests and monitor for anomalous patterns
• Implement real-time alerting for requests containing common XSS payload signatures
• Monitor user sessions for unexpected authentication events or privilege changes following external link access
• Set up file integrity monitoring for WordPress core files and plugin directories to detect any malicious modifications

How to Mitigate CVE-2025-30924

Immediate Actions Required

• Update the Primer MyData for WooCommerce plugin to version 4.2.4 or later immediately
• Review access logs for evidence of exploitation attempts targeting this vulnerability
• Invalidate and regenerate session tokens for all administrative users as a precaution
• Implement Content Security Policy headers to restrict inline script execution

Patch Information

The vulnerability has been addressed in Primer MyData for WooCommerce version 4.2.4. Organizations should update to this version or later through the WordPress plugin administration panel or by downloading the patched version from the official WordPress plugin repository. For detailed patch information, refer to the Patchstack Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable the Primer MyData for WooCommerce plugin until the update can be applied
• Implement a Web Application Firewall with XSS protection rules to filter malicious requests
• Restrict access to WordPress admin areas to trusted IP addresses only
• Educate users about the risks of clicking on suspicious or unexpected links

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';"

# For Nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';";