CVE-2025-3878: Cozyvision SMS Alert Order Notifications XSS

CVE-2025-3878 Overview

CVE-2025-3878 is a stored Cross-Site Scripting (XSS) vulnerability in the SMS Alert Order Notifications – WooCommerce plugin for WordPress, developed by Cozyvision. The flaw affects all versions up to and including 3.8.1 and resides in the plugin's sa_verify shortcode. The plugin fails to sanitize user-supplied attributes and does not escape output properly. Authenticated attackers holding contributor-level privileges or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page, enabling session theft, redirects, and content manipulation. The vulnerability is tracked under CWE-79.

Critical Impact
Contributor-level accounts can store malicious JavaScript through the sa_verify shortcode, executing attacker-controlled code in the browsers of site visitors and administrators.

Affected Products

Cozyvision SMS Alert Order Notifications – WooCommerce plugin for WordPress
All versions up to and including 3.8.1
Free WordPress distribution channel (cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:free:wordpress:*:*)

Discovery Timeline

2025-05-10 - CVE-2025-3878 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3878

Vulnerability Analysis

The vulnerability resides in the plugin's shortcode handler for sa_verify, defined in helper/shortcode.php. When WordPress processes shortcodes embedded in posts or pages, user-supplied attributes passed to sa_verify are rendered back into the page without proper sanitization or output escaping. An authenticated user with contributor privileges can insert the shortcode with malicious attribute values into content they are authorized to edit. Once the content is viewed by any visitor, including administrators, the stored payload executes in the victim's browser context. Successful exploitation can lead to session hijacking, forced administrative actions, phishing overlays, and persistent defacement of plugin-generated pages.

Root Cause

The root cause is insufficient input validation and missing output escaping within the sa_verify shortcode handler. Shortcode attributes passed through $atts are concatenated into HTML output without passing through WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses(). This allows HTML and JavaScript control characters supplied by the attacker to break out of the intended attribute context and introduce new script constructs. The vendor's patch, published as WordPress Plugin Changeset 3290478, addresses the issue by applying proper escaping to the affected attribute path.

Attack Vector

Exploitation requires an authenticated account with contributor-level access or higher and the ability for a victim to render the affected content. The attacker publishes or submits content containing a crafted sa_verify shortcode. When a reviewer, editor, administrator, or site visitor loads the page, the browser executes the injected JavaScript under the site's origin. The scope change in the CVSS vector reflects that the attacker's code executes in the context of other users' sessions, extending impact beyond the attacker's own account.

No verified exploit code is published for this CVE. Technical details on the vulnerable function are available in the WordPress Plugin Shortcode Code reference and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-3878

Indicators of Compromise

Pages or posts containing [sa_verify ...] shortcodes with attribute values that include <script>, onerror=, onload=, javascript:, or encoded equivalents
New or modified posts authored by contributor-level accounts that embed the sa_verify shortcode in unexpected contexts
Unexpected outbound requests from visitor browsers to attacker-controlled domains after rendering pages that use the plugin
Creation of new administrator accounts or unexpected privilege changes shortly after content containing the shortcode is published

Detection Strategies

Query the wp_posts table for post_content matching sa_verify combined with HTML event handler keywords or <script
Review web server access logs for POST requests to wp-admin/post.php and admin-ajax.php originating from contributor accounts followed by renders of the same post IDs
Monitor browser-side telemetry and endpoint identification logs for script execution on WordPress pages that triggers connections to unfamiliar domains

Monitoring Recommendations

Audit all installed WordPress plugins and compare installed versions against the vendor's advisory, flagging SMS Alert Order Notifications at version 3.8.1 or earlier
Enable WordPress audit logging for user role changes, post publishing by contributors, and plugin activation events
Deploy Content Security Policy (CSP) headers that restrict inline script execution to limit the blast radius of stored XSS

How to Mitigate CVE-2025-3878

Immediate Actions Required

Update the SMS Alert Order Notifications – WooCommerce plugin to the version containing changeset 3290478 or later
Review all posts and pages that embed the sa_verify shortcode and remove any attribute values containing script or event-handler content
Rotate session cookies and administrator passwords if evidence of injection is found
Restrict contributor-level accounts to trusted users and enforce multi-factor authentication for all content-editing roles

Patch Information

The vendor addressed CVE-2025-3878 in the WordPress plugin repository under changeset 3290478. The fix introduces proper sanitization and escaping of attributes consumed by the sa_verify shortcode handler. Site operators should install the fixed release through the WordPress plugin updater. Vendor information is published on the SMS Alert Plugin Developer page.

Workarounds

Deactivate the SMS Alert Order Notifications plugin until the patched version can be installed
Temporarily remove contributor and author-level permissions to use shortcodes by filtering the_content or disabling the shortcode via remove_shortcode('sa_verify') in a mu-plugin
Deploy a web application firewall rule that blocks requests containing sa_verify attributes with angle brackets, javascript: URIs, or inline event handlers

bash

# Configuration example: disable the vulnerable shortcode until patched
# Place the following in wp-content/mu-plugins/disable-sa-verify.php
<?php
add_action('init', function () {
    if (shortcode_exists('sa_verify')) {
        remove_shortcode('sa_verify');
    }
}, 20);