CVE-2025-39446 Overview
CVE-2025-39446 is a reflected Cross-Site Scripting (XSS) vulnerability in the Pluggabl LLC Booster Plus for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 7.2.4. Attackers can inject arbitrary JavaScript into web pages generated by the plugin due to improper neutralization of user-supplied input [CWE-79].
Exploitation requires a victim to click a crafted link. Once triggered, the injected script executes in the victim's browser under the site's origin, enabling session theft, credential harvesting, or forced administrative actions when the victim is a privileged user.
Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in a victim's browser session, potentially compromising administrator accounts on affected WooCommerce stores.
Affected Products
- Booster Plus for WooCommerce versions through 7.2.4
- WordPress installations running the vulnerable plugin
- WooCommerce e-commerce sites using Booster Plus extensions
Discovery Timeline
- 2025-05-19 - CVE-2025-39446 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39446
Vulnerability Analysis
The vulnerability stems from improper neutralization of input during web page generation within the Booster Plus for WooCommerce plugin. User-controlled parameters are reflected back into HTTP responses without adequate encoding or sanitization. This allows an attacker to inject HTML and JavaScript into rendered pages.
The issue is classified as reflected XSS, meaning the malicious payload is delivered through a request parameter rather than stored on the server. The scope change indicated by the CVSS vector (S:C) reflects that injected script can affect resources beyond the vulnerable component, such as authenticated administrator sessions.
The EPSS score for this vulnerability is 0.194%, placing it in the 9.33 percentile for exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been reported.
Root Cause
The root cause is missing output encoding on request parameters processed by the plugin. When the plugin renders these values back into HTML, browsers interpret injected <script> tags or event handlers as executable code rather than data.
Attack Vector
An attacker crafts a URL containing a malicious payload in a vulnerable parameter and delivers it to a target via phishing, forum posts, or malicious ads. When the victim, typically an authenticated administrator, opens the link, the payload executes in the WordPress site's origin. The attacker can then steal cookies, hijack the admin session, or invoke privileged plugin functions on behalf of the victim.
No synthetic proof-of-concept is included. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-39446
Indicators of Compromise
- HTTP requests to Booster Plus plugin endpoints containing URL-encoded <script>, javascript:, or onerror= payloads in query parameters
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
- New or modified WordPress administrator accounts, plugins, or themes without corresponding change records
Detection Strategies
- Inspect web server access logs for suspicious query strings targeting Booster Plus for WooCommerce URLs
- Deploy a Web Application Firewall (WAF) with rules that flag reflected XSS patterns in request parameters
- Correlate admin console activity with referrer headers pointing to external or unusual sources
Monitoring Recommendations
- Monitor WordPress audit logs for privileged actions initiated from unexpected IP addresses or user agents
- Alert on Content Security Policy (CSP) violation reports indicating blocked inline script execution
- Track plugin version inventory to identify sites still running Booster Plus for WooCommerce 7.2.4 or earlier
How to Mitigate CVE-2025-39446
Immediate Actions Required
- Update Booster Plus for WooCommerce to a version later than 7.2.4 as soon as the vendor patch is available
- Audit administrator accounts for signs of unauthorized activity, session anomalies, or unexpected configuration changes
- Force a password reset and session invalidation for all WordPress users with elevated privileges
Patch Information
Review the Patchstack Vulnerability Report for vendor patch status and upgrade guidance. Sites running versions through 7.2.4 must upgrade to a fixed release once published.
Workarounds
- Deploy a WAF rule set that blocks reflected XSS payloads targeting the Booster Plus for WooCommerce plugin
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
- Restrict WordPress administrator access to trusted networks and require multi-factor authentication for all privileged accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
