CVE-2025-30972: WooCommerce Line Notify Stored XSS Flaw

CVE-2025-30972 Overview

CVE-2025-30972 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce Line Notify WordPress plugin (woo-line-notify) developed by iamapinan. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject and persistently store malicious scripts within the application.

Stored XSS vulnerabilities are particularly dangerous because the malicious payload is permanently stored on the target server and executed whenever users access the affected page. In the context of an e-commerce plugin like WooCommerce Line Notify, this could impact both administrators managing the store and potentially customers interacting with notification features.

Critical Impact

Attackers can inject persistent malicious scripts that execute in the context of authenticated users, potentially leading to session hijacking, credential theft, or unauthorized actions within the WordPress administration panel.

Affected Products

• WooCommerce Line Notify plugin versions from n/a through <= 1.1.7
• WordPress installations running vulnerable versions of the woo-line-notify plugin
• E-commerce sites using Line Notify integration with WooCommerce

Discovery Timeline

• 2025-06-27 - CVE CVE-2025-30972 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30972

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) exists in the WooCommerce Line Notify plugin's input handling mechanisms. The plugin fails to properly sanitize user-supplied input before storing it in the database and subsequently rendering it on web pages. This allows an attacker to inject JavaScript or HTML code that persists in the application's data store.

The attack requires user interaction, as victims must view the page containing the stored malicious payload. Once triggered, the script executes within the victim's browser context with the same privileges as the authenticated user. Given that WordPress plugins often handle administrative functions, successful exploitation could lead to complete site compromise if an administrator triggers the payload.

The vulnerability affects all versions of the plugin up to and including version 1.1.7, indicating a fundamental flaw in the input validation and output encoding logic throughout the plugin's codebase.

Root Cause

The root cause of CVE-2025-30972 is the absence of proper input sanitization and output encoding within the WooCommerce Line Notify plugin. WordPress provides several sanitization functions such as sanitize_text_field(), esc_html(), and esc_attr() that should be used when handling user input and rendering output. The plugin's failure to implement these security controls allows malicious content to be stored and rendered without neutralization.

Additionally, the plugin likely lacks proper Content Security Policy headers and does not leverage WordPress's built-in escaping functions when displaying stored data back to users, creating the conditions necessary for Stored XSS attacks.

Attack Vector

The attack is network-based and can be executed remotely. An attacker would typically follow this exploitation path:

1. Identify input fields within the WooCommerce Line Notify plugin that accept and store user data
2. Craft a malicious payload containing JavaScript code designed to execute specific actions
3. Submit the payload through the vulnerable input mechanism
4. Wait for an authenticated user (preferably an administrator) to view the page containing the stored payload
5. The malicious script executes in the victim's browser, potentially stealing session cookies, performing unauthorized actions, or redirecting users to phishing pages

The vulnerability does not require authentication for initial payload injection in many scenarios, making it accessible to unauthenticated attackers. For detailed technical analysis, refer to the Patchstack WooCommerce Vulnerability Analysis.

Detection Methods for CVE-2025-30972

Indicators of Compromise

• Unexpected JavaScript code or HTML tags appearing in database fields related to the WooCommerce Line Notify plugin
• Browser developer console showing execution of unknown scripts on pages utilizing the plugin
• Unusual outbound connections from user browsers when accessing WooCommerce or Line Notify settings
• Reports from users of unexpected redirects, pop-ups, or credential prompts when accessing the WordPress admin panel

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in HTTP requests
• Enable WordPress security plugins that monitor for suspicious script injections and database modifications
• Deploy browser-based XSS detection tools or Content Security Policy violation reporting
• Conduct regular security scans using tools like WPScan to identify vulnerable plugin versions

Monitoring Recommendations

• Configure logging for all input submissions to WooCommerce Line Notify plugin fields
• Monitor WordPress database tables associated with the plugin for unexpected HTML or JavaScript content
• Set up alerts for Content Security Policy violations that may indicate XSS attempts
• Implement real-time monitoring for unusual administrative actions that could result from session hijacking

How to Mitigate CVE-2025-30972

Immediate Actions Required

• Audit the WooCommerce Line Notify plugin configuration and stored data for evidence of malicious script injection
• Consider temporarily disabling the WooCommerce Line Notify plugin until a patched version is available
• Implement a Web Application Firewall with XSS protection rules to filter malicious input
• Review WordPress user sessions and invalidate any potentially compromised administrative sessions
• Enable Content Security Policy headers to restrict inline script execution

Patch Information

At the time of this writing, administrators should check for updates to the WooCommerce Line Notify plugin beyond version 1.1.7. Monitor the WordPress plugin repository and the Patchstack vulnerability database for security updates and patch announcements from the plugin developer.

Ensure automatic updates are enabled for WordPress plugins, or establish a regular manual update schedule to apply security patches promptly when released.

Workarounds

• Disable the WooCommerce Line Notify plugin if the functionality is not critical to business operations
• Implement server-level input filtering using ModSecurity or similar WAF solutions with OWASP Core Rule Set
• Add Content Security Policy headers to prevent inline script execution: Content-Security-Policy: script-src 'self'
• Restrict access to WordPress administrative areas using IP whitelisting or VPN requirements
• Consider alternative Line Notify integration methods that have been security audited

# Configuration example - Add CSP headers in .htaccess for Apache
<IfModule mod_headers.c>
    Header set Content-Security-Policy "script-src 'self'; object-src 'none';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>