CVE-2025-32602: WooMS Plugin Reflected XSS Vulnerability

CVE-2025-32602 Overview

CVE-2025-32602 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WooMS plugin for WordPress, developed by wpcraft. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All versions of WooMS up to and including 9.12 are affected. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes attacker-controlled JavaScript in the victim's browser session.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, leading to session hijacking, credential theft, or redirection to attacker-controlled infrastructure when an authenticated administrator interacts with a malicious link.

Affected Products

WooMS WordPress plugin by wpcraft
All versions from initial release through 9.12
WordPress sites integrating WooMS for MoySklad synchronization

Discovery Timeline

2025-04-17 - CVE-2025-32602 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32602

Vulnerability Analysis

The WooMS plugin fails to properly sanitize and encode user-controlled input before reflecting it into HTTP responses. This deficiency allows attacker-supplied payloads passed through request parameters to be rendered as executable script within the resulting HTML document. Because the attack is reflected, exploitation requires user interaction, typically tricking a logged-in WordPress user into clicking a crafted link.

The vulnerability is network-accessible and requires no prior authentication on the target site. The scope is changed, meaning the executed script can affect resources beyond the vulnerable component, including the WordPress administrative session of the targeted user.

Root Cause

The root cause is missing or insufficient output encoding of request parameters echoed back into plugin-generated pages. WordPress provides sanitization helpers such as esc_html(), esc_attr(), and esc_url(), but the affected WooMS code paths in versions up to 9.12 do not consistently apply them to reflected values.

Attack Vector

An attacker constructs a URL targeting a vulnerable WooMS endpoint with a JavaScript payload embedded in a reflected parameter. The attacker delivers the URL through phishing, forum posts, or other social-engineering channels. When a victim with an active WordPress session visits the link, the browser executes the injected script under the site's origin. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32602

Indicators of Compromise

HTTP requests to WooMS plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: strings in query parameters
Web server access logs showing unusual referrers chained with WooMS plugin paths under /wp-content/plugins/wooms/
Browser console errors or unexpected outbound requests from administrative sessions to unfamiliar domains

Detection Strategies

Inspect web application firewall (WAF) logs for reflected XSS signatures targeting WordPress plugin parameters
Review WordPress audit logs for administrator activity correlated with suspicious inbound URLs containing encoded script payloads
Deploy content security policy (CSP) violation reporting to surface inline-script execution attempts originating from the WooMS plugin scope

Monitoring Recommendations

Alert on outbound requests from WordPress administrator sessions to newly registered or low-reputation domains
Monitor changes to administrator accounts, plugin installations, and theme files following any suspected XSS interaction
Aggregate WordPress access logs into a centralized analytics platform to baseline plugin parameter usage and flag anomalies

How to Mitigate CVE-2025-32602

Immediate Actions Required

Upgrade WooMS to a version released after 9.12 that addresses the reflected XSS issue, once available from wpcraft
Restrict access to the WordPress administrative interface to trusted IP ranges and enforce multi-factor authentication for all privileged accounts
Educate administrators not to click unsolicited links targeting the WordPress admin panel

Patch Information

At the time of publication, the affected vendor (wpcraft) is identified through the Patchstack WordPress Vulnerability Report. Site operators should monitor the WordPress plugin repository for a fixed release of WooMS above version 9.12 and apply the update immediately.

Workarounds

Deploy a WAF rule blocking requests to WooMS endpoints containing script-like payloads in query parameters
Implement a strict Content Security Policy that disallows inline script execution on the WordPress admin domain
Temporarily deactivate the WooMS plugin if business operations permit until a patched version is installed

bash

# Example WAF rule (ModSecurity) blocking reflected XSS patterns on WooMS endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/wooms/" \
    "chain,id:1003260,phase:2,deny,status:403,msg:'CVE-2025-32602 WooMS Reflected XSS'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni"