CVE-2025-32513: Nomupay Payment Gateway XSS Vulnerability

CVE-2025-32513 Overview

CVE-2025-32513 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Total Processing Nomupay Payment Processing Gateway plugin (totalprocessing-card-payments) for WooCommerce on WordPress. The flaw stems from improper neutralization of user-controlled input during web page generation. Attackers can craft malicious URLs that, when opened by an authenticated administrator or store user, execute arbitrary JavaScript in the victim's browser session.

The issue affects all plugin versions up to and including 7.1.6. Because the plugin handles WooCommerce payment flows, exploitation can target merchants and store administrators directly.

Critical Impact

Reflected XSS in a payment processing plugin enables session hijacking, administrative account takeover, and injection of malicious scripts into checkout-adjacent pages.

Affected Products

• Total Processing Nomupay Payment Processing Gateway plugin for WooCommerce
• Plugin versions from initial release through 7.1.6
• WordPress sites running WooCommerce with the totalprocessing-card-payments plugin enabled

Discovery Timeline

• 2025-04-17 - CVE-2025-32513 published to NVD via Patchstack
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32513

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw classified under [CWE-79]. The plugin echoes one or more request parameters back into HTML responses without proper output encoding or input sanitization. An attacker who can convince a logged-in user to click a crafted link triggers JavaScript execution in the victim's authenticated session.

Successful exploitation allows an attacker to read session cookies accessible to script, perform actions as the victim, modify rendered checkout content, or pivot toward administrator account compromise. Because the plugin operates within the payment workflow, malicious script execution against store administrators carries elevated risk for merchant accounts and connected gateway configuration.

The CVSS vector indicates user interaction is required and the scope changes, reflecting that the injected script can affect resources beyond the vulnerable component. The current EPSS probability remains low, indicating no widespread observed exploitation activity at the time of publication.

Root Cause

The plugin fails to apply context-appropriate escaping (such as esc_html(), esc_attr(), or wp_kses()) to request-derived data before rendering it within plugin-controlled pages. Missing output encoding allows angle brackets, quotes, and event handler attributes supplied by an attacker to be interpreted as HTML and JavaScript by the browser.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker constructs a URL pointing at a vulnerable plugin endpoint with a payload embedded in a query parameter. The attacker then delivers that URL through phishing, a malicious referrer, or an embedded link on an attacker-controlled site. When an authenticated WordPress user opens the link, the plugin reflects the unsanitized payload into the response, and the browser executes the injected script under the site's origin. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-32513

Indicators of Compromise

• HTTP request logs containing <script>, onerror=, onload=, or javascript: substrings within query parameters targeting totalprocessing-card-payments plugin paths.
• Outbound browser requests from administrator sessions to unfamiliar external domains shortly after clicking inbound links.
• Unexpected WordPress administrator account changes, new user creation, or modified plugin settings following user link interactions.

Detection Strategies

• Inspect web server and WAF logs for URL-encoded XSS payload patterns (%3Cscript, %22onerror, javascript%3A) directed at plugin endpoints.
• Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for inline script execution attempts on WooCommerce pages.
• Run authenticated vulnerability scans against staging WordPress instances to confirm the installed plugin version is greater than 7.1.6.

Monitoring Recommendations

• Alert on administrator session activity that originates from unusual referrers or includes scripted DOM modifications to checkout pages.
• Monitor WordPress audit logs for privilege changes, option updates, and new administrative users immediately after suspicious link clicks.
• Forward web server, WAF, and WordPress application logs to a centralized analytics platform such as Singularity Data Lake for correlated detection across endpoint and web telemetry.

How to Mitigate CVE-2025-32513

Immediate Actions Required

• Update the Total Processing Nomupay Payment Processing Gateway plugin to a version later than 7.1.6 as soon as the vendor publishes a fixed release.
• Audit WordPress administrator and shop manager accounts for unauthorized changes since plugin installation.
• Force password resets and invalidate active sessions for users who may have clicked untrusted links targeting the site.

Patch Information

At the time of NVD publication, the advisory lists all versions through 7.1.6 as affected. Site operators should consult the Patchstack Vulnerability Report and the plugin vendor for the patched release and apply it through the WordPress plugin update mechanism.

Workarounds

• Deactivate the totalprocessing-card-payments plugin until a patched version is installed if administrators interact with untrusted links.
• Deploy a Web Application Firewall rule that blocks requests containing common XSS payload patterns aimed at the plugin's endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Restrict administrative access to known IP ranges and require strong multi-factor authentication for all WooCommerce privileged accounts.

# Example WordPress CLI workflow to identify and update the affected plugin
wp plugin list --name=totalprocessing-card-payments --fields=name,status,version
wp plugin update totalprocessing-card-payments
wp plugin deactivate totalprocessing-card-payments  # if no patched version is yet available