CVE-2025-4212: WooCommerce Checkout Files Upload XSS Flaw

CVE-2025-4212 Overview

CVE-2025-4212 affects the Checkout Files Upload for WooCommerce plugin for WordPress. The vulnerability allows unauthenticated attackers to perform Stored Cross-Site Scripting [CWE-79] through the file upload functionality. All versions up to and including 2.2.1 are vulnerable due to insufficient input sanitization and output escaping. Attackers can inject arbitrary web scripts into image files that execute when any user accesses the affected page. The flaw was patched in version 2.2.2.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into WooCommerce checkout pages, enabling session theft, administrative account takeover, and arbitrary redirection of store visitors.

Affected Products

Checkout Files Upload for WooCommerce plugin versions up to and including 2.2.1
WordPress sites running WooCommerce with this plugin installed
Fixed in plugin version 2.2.2

Discovery Timeline

2025-11-18 - CVE-2025-4212 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4212

Vulnerability Analysis

The Checkout Files Upload for WooCommerce plugin permits customers to attach files during the checkout process. The plugin fails to properly sanitize user-supplied file content and does not escape output when the uploaded files are rendered in the admin or order context. This creates a Stored Cross-Site Scripting [CWE-79] condition exploitable by unauthenticated users.

Attackers upload crafted image files containing embedded JavaScript payloads. Because the plugin processes file content through the checkout flow without authentication, any visitor can submit malicious payloads. When an administrator or other user later views the order page containing the uploaded file, the browser executes the injected script in the context of the WordPress site.

Root Cause

The root cause is twofold. First, the plugin does not validate or sanitize the contents of uploaded files for script payloads. Second, file metadata and references are rendered into HTML pages without proper output escaping. Image files such as SVG or files with manipulated headers can contain executable script content that browsers will parse and run.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond a victim viewing the affected page. An attacker initiates a checkout on the target WooCommerce store and uploads a malicious file through the plugin's checkout upload field. The payload persists in the store's order data. When a store administrator opens the order to review the attached file, the script executes with the administrator's session privileges. The scope changes from the attacker's submission to the administrative browser context, which is why this vulnerability carries a scope-changed rating.

For full technical details, see the Wordfence Vulnerability Report and the WordPress Plugin Changelog.

Detection Methods for CVE-2025-4212

Indicators of Compromise

Uploaded files in the WooCommerce checkout uploads directory containing <script> tags, onerror= handlers, or SVG files with embedded JavaScript
Unexpected administrator account creation or privilege changes following order review activity
Outbound requests from administrator browsers to attacker-controlled domains after viewing order details
WordPress option or user table modifications without corresponding administrator action logs

Detection Strategies

Inspect files in the plugin upload directory for HTML or JavaScript content within files declared as images
Review WooCommerce order metadata for unusual file attachments submitted by unauthenticated checkout sessions
Monitor WordPress audit logs for unexpected privilege escalation, plugin installation, or theme modification events
Use a web application firewall to flag checkout submissions containing script-like payloads in file content or filenames

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads directory and WooCommerce-specific upload paths
Log and alert on administrator browser sessions making cross-origin requests immediately after order page access
Track plugin version inventory across WordPress installations to identify hosts still running versions at or below 2.2.1
Review WooCommerce order logs for repeated checkout attempts with file uploads from the same IP

How to Mitigate CVE-2025-4212

Immediate Actions Required

Update the Checkout Files Upload for WooCommerce plugin to version 2.2.2 or later on all WordPress installations
Audit existing uploaded files in WooCommerce checkout directories for malicious script content and remove any suspicious files
Rotate WordPress administrator credentials and active session tokens if the plugin was running a vulnerable version
Review recent WooCommerce orders containing file attachments for signs of exploitation

Patch Information

The vendor released version 2.2.2 to address CVE-2025-4212. The fix introduces proper input sanitization on file uploads and output escaping when rendering file references. Site administrators should apply the patch through the WordPress plugin dashboard or by downloading the updated package directly. Patch details are available in the WordPress Plugin Changelog.

Workarounds

Disable the Checkout Files Upload for WooCommerce plugin until the patched version can be deployed
Deploy a web application firewall rule to block uploads containing <script, javascript:, or SVG content through the checkout endpoint
Restrict accepted file types in the plugin configuration to formats that do not support embedded script execution, such as PDF or plain image formats with strict MIME validation
Apply Content Security Policy headers that disallow inline script execution on WordPress administrative pages

bash

# Configuration example: WordPress CLI patch deployment
wp plugin update checkout-files-upload-woocommerce --version=2.2.2
wp plugin list --name=checkout-files-upload-woocommerce --fields=name,status,version