CVE-2025-32920: TI WooCommerce Wishlist XSS Vulnerability

CVE-2025-32920 Overview

CVE-2025-32920 is a stored cross-site scripting (XSS) vulnerability in the TI WooCommerce Wishlist plugin for WordPress, developed by templateinvaders. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject malicious scripts that persist and execute in the browsers of other users, including administrators. The vulnerability affects all versions of ti-woocommerce-wishlist up to and including 2.10.0. Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed in the context of the victim's session.

Critical Impact
Stored XSS enables persistent script execution against site visitors and administrators, with potential for privilege escalation through hijacked admin sessions.

Affected Products

TI WooCommerce Wishlist plugin (ti-woocommerce-wishlist) versions up to and including 2.10.0
WordPress sites running WooCommerce with the affected plugin
Templateinvaders TI WooCommerce Wishlist (all releases prior to the patched version)

Discovery Timeline

2025-05-19 - CVE-2025-32920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32920

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The plugin fails to properly sanitize or encode user-controlled input before rendering it in web pages generated by the wishlist functionality. An attacker with low-privilege authenticated access can inject JavaScript payloads into fields processed by the plugin.

Because the payload is stored server-side, it executes every time an affected page is rendered for any user. The vulnerability requires user interaction, and successful exploitation can impact resources beyond the vulnerable component due to the scope change reflected in the CVSS vector.

The Patchstack XSS Vulnerability Advisory provides additional technical context on the affected code paths.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders wishlist-related data supplied by users. The plugin does not apply appropriate WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before echoing user input into HTML contexts. This allows raw HTML and JavaScript to pass through into rendered pages.

Attack Vector

An authenticated attacker with a low-privilege account submits a crafted payload containing HTML or JavaScript through an input field processed by the wishlist plugin. The plugin stores the payload without sanitization. When another user, including a site administrator, views the affected page, the browser executes the injected script in the context of the site origin.

The attacker can leverage this to steal session cookies, perform actions on behalf of the victim, or redirect users to attacker-controlled infrastructure. Because the payload persists, it continues to affect every visitor until removed.

See the Patchstack advisory for technical details on the affected input handling.

Detection Methods for CVE-2025-32920

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= and onload= in wishlist data stored in the WordPress database
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading wishlist-related pages
Newly created WordPress administrator accounts or modified user roles without a corresponding audit trail
Session cookie exfiltration patterns in web server or reverse proxy logs

Detection Strategies

Query the wp_options, wp_usermeta, and plugin-specific tables for HTML tags or JavaScript keywords in wishlist entries
Deploy a web application firewall (WAF) rule set that inspects POST parameters targeting ti-woocommerce-wishlist endpoints for XSS patterns
Enable a strict Content Security Policy (CSP) and monitor report-uri or report-to endpoints for violations originating from wishlist pages

Monitoring Recommendations

Log all authenticated user submissions to wishlist endpoints and review for suspicious payloads
Monitor administrator session activity for anomalous API calls following visits to wishlist pages
Track plugin version inventory across WordPress installations to identify hosts running ti-woocommerce-wishlist 2.10.0 or earlier

How to Mitigate CVE-2025-32920

Immediate Actions Required

Update the TI WooCommerce Wishlist plugin to the latest patched version released by templateinvaders
Audit existing wishlist data in the WordPress database for previously injected payloads and remove any malicious content
Rotate credentials and invalidate active sessions for administrator accounts that may have viewed compromised pages
Restrict account creation and require strong authentication for users who can interact with wishlist functionality

Patch Information

Refer to the Patchstack XSS Vulnerability Advisory and the templateinvaders plugin changelog for the fixed release version. Update to a version later than 2.10.0. Verify the installed version through the WordPress admin dashboard under Plugins.

Workarounds

Disable the TI WooCommerce Wishlist plugin until the patch is applied
Deploy a WAF rule that blocks HTML and JavaScript characters in requests to wishlist endpoints
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit low-privilege account registration to reduce the pool of potential attackers

bash

# Check installed plugin version via WP-CLI
wp plugin get ti-woocommerce-wishlist --field=version

# Update the plugin to the latest available version
wp plugin update ti-woocommerce-wishlist

# Temporarily deactivate the plugin if a patch is not yet applied
wp plugin deactivate ti-woocommerce-wishlist