CVE-2025-32602: WooMS Plugin Reflected XSS Vulnerability

CVE-2025-32602 Overview

CVE-2025-32602 is a reflected Cross-Site Scripting (XSS) vulnerability in the wpcraft WooMS plugin for WordPress. The flaw affects all versions of WooMS up to and including 9.12. The plugin fails to properly neutralize user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions performed in the context of the targeted user.

Critical Impact

A network-based attacker can execute arbitrary scripts in a victim's browser by tricking the user into clicking a crafted link, potentially compromising WordPress administrator sessions.

Affected Products

• wpcraft WooMS WordPress plugin versions up to and including 9.12
• WordPress installations using the WooMS integration plugin
• Sites running WooCommerce with WooMS for MoySklad synchronization

Discovery Timeline

• 2025-04-17 - CVE-2025-32602 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in the NVD database

Technical Details for CVE-2025-32602

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS) [CWE-79]. The WooMS plugin reflects untrusted input from HTTP request parameters back into rendered HTML pages without applying proper output encoding or input sanitization. This allows an attacker to inject JavaScript payloads that execute in the context of the WordPress site's origin.

Because the attack vector is network-based and requires user interaction, exploitation typically involves social engineering. An attacker delivers a crafted URL through phishing emails, malicious links, or compromised pages. When a victim with an active WordPress session clicks the link, the injected script runs with the privileges of that session.

The CVSS scope is rated as changed, indicating that the impact extends beyond the vulnerable component to other browser-trust boundaries. Confidentiality, integrity, and availability are all affected at a limited level.

Root Cause

The root cause lies in the WooMS plugin's handling of request parameters that are echoed into HTML responses. The plugin does not apply functions such as esc_html(), esc_attr(), or wp_kses() from the WordPress API to sanitize user-controlled values before output. This omission allows raw HTML and JavaScript characters to reach the rendered page.

Attack Vector

An attacker constructs a URL pointing to a vulnerable WooMS endpoint with a malicious payload embedded in a request parameter. The attacker distributes the link to a target user who has access to the affected WordPress site. When the victim visits the link, the server reflects the payload into the response, and the browser executes the injected script. The script can read cookies, exfiltrate session tokens, or perform privileged actions on behalf of the user. Technical details are documented in the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2025-32602

Indicators of Compromise

• Web server access logs showing requests to WooMS plugin endpoints with suspicious query strings containing <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
• Unusual outbound requests from administrator browsers to attacker-controlled domains shortly after accessing WooMS-related URLs
• Unexpected administrative actions or new user accounts created without a corresponding legitimate login event

Detection Strategies

• Inspect HTTP request and response pairs for reflected content where input parameters appear unescaped in HTML response bodies
• Deploy a Web Application Firewall (WAF) with signatures for common XSS payloads targeting WordPress plugin parameters
• Correlate referrer headers and click events from email gateways with WordPress admin session activity to identify phishing-driven exploitation

Monitoring Recommendations

• Enable WordPress audit logging to capture administrator actions, plugin changes, and user modifications
• Forward web server logs to a centralized analytics platform for anomaly detection on WooMS endpoint parameters
• Monitor browser-based telemetry from privileged users for unexpected script execution or DOM modifications on WordPress admin pages

How to Mitigate CVE-2025-32602

Immediate Actions Required

• Identify all WordPress sites running the WooMS plugin and inventory installed versions
• Disable or deactivate the WooMS plugin on affected sites until a patched version is available and applied
• Force re-authentication of all WordPress administrator and editor accounts to invalidate potentially stolen sessions
• Review recent administrator activity logs for unauthorized changes

Patch Information

At the time of publication, the vulnerability affects WooMS versions through 9.12. Administrators should consult the Patchstack advisory and the vendor's WordPress plugin repository page for the latest fixed release and apply it through the WordPress plugin updater.

Workarounds

• Deploy a WAF rule to block requests containing XSS payload patterns directed at WooMS endpoints
• Apply Content Security Policy (CSP) headers that restrict inline script execution and limit allowed script sources
• Restrict access to the WordPress admin interface by IP allowlist to reduce the attack surface for reflected XSS targeting privileged users
• Train administrators and editors to avoid clicking unsolicited links that reference their WordPress site

# Example nginx configuration to add a baseline Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;