CVE-2025-31598: WooCommerce Dynamic Pricing XSS Vulnerability

CVE-2025-31598 Overview

CVE-2025-31598 is a stored cross-site scripting (XSS) vulnerability in the WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin (wholesale-pricing-woocommerce). The flaw affects all versions from initial release through 4.0.3. An authenticated attacker with low privileges can inject malicious JavaScript that persists in stored plugin data and executes in the browsers of other users viewing affected pages. The vulnerability is classified under CWE-79, improper neutralization of input during web page generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes across user sessions, enabling session theft, administrator account takeover, and unauthorized WooCommerce store modifications.

Affected Products

WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin
All plugin versions up to and including 4.0.3
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-03-31 - CVE-2025-31598 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31598

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation within the WPFactory plugin. The plugin accepts input from users with limited privileges and stores it without proper sanitization or output encoding. When the stored content is later rendered in a WordPress administrative or storefront context, the browser executes the injected script.

Stored XSS in WooCommerce plugins carries elevated risk because malicious payloads persist in the database. Any administrator, shop manager, or customer viewing the affected page becomes a target. The scope-changed attribute of this issue indicates the injected script executes in a security context different from where it was injected, extending impact beyond the vulnerable component.

Root Cause

The root cause is missing input validation and output escaping on fields exposed to authenticated users. WordPress provides sanitization functions such as sanitize_text_field(), wp_kses_post(), and escaping helpers like esc_html() and esc_attr(). The plugin failed to apply these consistently on inputs written to and rendered from persistent storage, allowing HTML and JavaScript payloads to survive round-tripping through the database.

Attack Vector

Exploitation requires an authenticated account with low privileges on the target WordPress site. The attacker submits a crafted payload through a plugin form field. The payload is stored in the WordPress database. When a victim, typically an administrator managing pricing rules, loads the affected page, the browser parses and executes the injected script. User interaction is required to trigger the payload, but standard administrative workflows are sufficient.

Refer to the Patchstack advisory for additional technical context on the affected input handlers.

Detection Methods for CVE-2025-31598

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings in WooCommerce pricing rule records within the WordPress database
Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin configuration pages
Newly created administrator accounts or modified user roles without a corresponding audit trail
Unauthorized changes to WooCommerce product pricing, discount tiers, or checkout logic

Detection Strategies

Query the wp_options and plugin-specific tables for HTML tags or script fragments in fields that should contain plain text or numeric values
Review web server logs for POST requests to plugin endpoints containing encoded angle brackets or common XSS payload patterns
Deploy a web application firewall (WAF) with rules that flag reflected and stored XSS attempts against WordPress admin endpoints

Monitoring Recommendations

Enable WordPress audit logging to record all changes to plugin configuration and user roles
Monitor browser-side content security policy (CSP) violation reports from the WordPress admin domain
Alert on anomalous session activity for administrator and shop manager accounts, including new geographies or IP ranges

How to Mitigate CVE-2025-31598

Immediate Actions Required

Identify all WordPress installations running Quantity Dynamic Pricing & Bulk Discounts for WooCommerce version 4.0.3 or earlier
Restrict plugin form access to trusted accounts and audit existing low-privilege users for suspicious activity
Review stored plugin data for injected HTML or JavaScript and remove any malicious content
Rotate credentials for administrator and shop manager accounts if compromise is suspected

Patch Information

At the time of publication, the vendor advisory tracked on Patchstack lists the vulnerability as affecting versions through 4.0.3. Administrators should upgrade to the latest available release from the WordPress plugin repository and verify the version installed after update.

Workarounds

Deactivate and remove the plugin until a patched version is confirmed installed
Apply a virtual patch through a WAF that filters script tags and event handler attributes on plugin admin endpoints
Enforce a strict content security policy on the WordPress admin domain to limit inline script execution
Limit the number of accounts with contributor-level or higher privileges to reduce the attacker pool

bash

# Configuration example: identify installations of the affected plugin
wp plugin list --path=/var/www/html --fields=name,version,status \
  | grep wholesale-pricing-woocommerce

# Force update to the latest available version
wp plugin update wholesale-pricing-woocommerce --path=/var/www/html