CVE-2025-32207: Ni WooCommerce Cost Of Goods XSS Vulnerability

CVE-2025-32207 Overview

CVE-2025-32207 is a stored cross-site scripting (XSS) vulnerability in the Ni WooCommerce Cost Of Goods plugin for WordPress. The flaw affects all plugin versions up to and including 3.2.8. An authenticated attacker with low privileges can inject malicious script payloads that persist in the application and execute in the browser of any user who views the affected page. Because the stored payload crosses a security boundary (scope change), the impact extends beyond the vulnerable component to other parts of the WordPress site. The vulnerability is tracked under [CWE-79] and was published to the National Vulnerability Database on April 4, 2025.

Critical Impact
An authenticated attacker can inject persistent JavaScript into the WooCommerce admin or storefront context, enabling session theft, administrative action abuse, and WordPress account takeover.

Affected Products

Ni WooCommerce Cost Of Goods plugin (ni-woocommerce-cost-of-goods)
All versions from n/a through 3.2.8
WordPress sites running WooCommerce with the plugin installed

Discovery Timeline

2025-04-04 - CVE-2025-32207 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32207

Vulnerability Analysis

The Ni WooCommerce Cost Of Goods plugin fails to properly neutralize user-supplied input during web page generation. Input accepted through plugin forms or request parameters is written back into rendered HTML without adequate output encoding or sanitization. An attacker with at least contributor-level credentials can submit a payload containing JavaScript. The payload is stored server-side and later rendered in the context of other users, including administrators. Because this is a stored XSS variant, exploitation does not require the attacker to deliver a crafted link per session. The injected script executes with the privileges of the viewing user inside the WordPress origin.

Root Cause

The underlying defect is improper neutralization of input during web page generation, classified as [CWE-79]. The plugin trusts input values written to the database and reflects them into HTML output without context-aware escaping functions such as esc_html(), esc_attr(), or wp_kses(). This design error allows arbitrary markup and script to persist across requests.

Attack Vector

Exploitation requires network access to the WordPress site and valid low-privileged credentials. The attacker submits a payload through a plugin field that is subsequently rendered to another user. User interaction, such as visiting the affected admin screen, triggers execution. The scope change in the CVSS vector indicates the stored script can affect resources outside the vulnerable plugin, including the broader WordPress session and administrative interface. Successful exploitation enables cookie theft, forced administrative actions through the WordPress REST API or admin-ajax endpoints, and persistence through creation of rogue administrator accounts.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-32207

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) stored in wp_postmeta, wp_options, or plugin-specific tables
New WordPress administrator accounts created shortly after an authenticated user viewed a Cost Of Goods admin page
Outbound HTTP requests from administrator browser sessions to attacker-controlled domains referenced in stored plugin fields
WooCommerce order or product records containing HTML entities, obfuscated JavaScript, or base64-encoded payloads in cost-related fields

Detection Strategies

Query the WordPress database for plugin fields containing <script, javascript:, onerror=, or onload= substrings
Review WordPress access logs for POST requests from low-privileged accounts to plugin endpoints followed by admin visits to affected pages
Audit wp_users and wp_usermeta for role changes or account creation events originating from administrative sessions

Monitoring Recommendations

Enable WordPress audit logging to track content changes submitted by shop managers and contributors
Deploy a web application firewall rule set that inspects POST bodies for script tags on plugin endpoints
Alert on anomalous administrative actions, such as plugin installation or user role elevation, triggered within minutes of plugin page views

How to Mitigate CVE-2025-32207

Immediate Actions Required

Identify all WordPress sites running the Ni WooCommerce Cost Of Goods plugin at version 3.2.8 or earlier
Update to a patched release above 3.2.8 as soon as the vendor publishes a fix; monitor the Patchstack advisory for release information
Audit existing plugin data for stored script payloads and remove any malicious entries
Rotate credentials and sessions for all administrator accounts that may have viewed tainted pages

Patch Information

The advisory indicates the vulnerability affects versions through 3.2.8. Review the Patchstack database entry for current fix availability and upgrade to the next vendor-released version containing the sanitization fix. If a patch is not yet available, consider disabling the plugin until a fix is published.

Workarounds

Deactivate the Ni WooCommerce Cost Of Goods plugin until a patched version is available
Restrict access to the plugin's admin pages using role-based access controls or server-level IP allowlisting
Deploy a WAF rule to block requests containing script tags or JavaScript event handlers targeting plugin endpoints
Enforce a strict Content Security Policy that disallows inline script execution in the WordPress admin context

bash

# Example WP-CLI command to deactivate the vulnerable plugin
wp plugin deactivate ni-woocommerce-cost-of-goods --all-sites

# Search the database for stored script payloads in plugin tables
wp db query "SELECT meta_id, post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%';"