CVE-2025-48251: WooCommerce Custom Emails Stored XSS Flaw

CVE-2025-48251 Overview

CVE-2025-48251 is a stored cross-site scripting (XSS) vulnerability in the WPFactory Additional Custom Emails & Recipients for WooCommerce plugin (custom-emails-for-woocommerce). The flaw affects all versions up to and including 3.5.1. Authenticated users with low-privileged access can inject persistent JavaScript payloads that execute in the browsers of other users viewing the affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Because the injected script executes in a scope change (S:C), the impact can extend beyond the vulnerable component to other browser contexts.

Critical Impact

Authenticated attackers can store malicious JavaScript in plugin fields, enabling session theft, administrative action hijacking, and WooCommerce store defacement when victims render the affected content.

Affected Products

• WPFactory Additional Custom Emails & Recipients for WooCommerce (custom-emails-for-woocommerce) versions up to and including 3.5.1
• WordPress sites running WooCommerce with the affected plugin installed
• Any administrator or shop manager account viewing rendered plugin output

Discovery Timeline

• 2025-05-19 - CVE-2025-48251 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48251

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation within the plugin's custom email configuration interface. Input passed into plugin fields is not sanitized on write and is not properly escaped on output. As a result, script payloads persist in the WordPress database and execute when a privileged user views the rendered content. Exploitation requires an authenticated session and user interaction to trigger the payload, but the changed scope means the injected script can affect content served under a different security context. According to public data, the EPSS probability for exploitation is 0.258% at the 17.8 percentile, and no public exploit is currently listed in ExploitDB or the CISA KEV catalog.

Root Cause

The plugin fails to apply WordPress sanitization primitives such as sanitize_text_field(), wp_kses(), or context-appropriate escaping helpers like esc_html() and esc_attr() when handling custom email configuration input. Persisted values are echoed into the admin interface without neutralization, allowing HTML and JavaScript tokens to survive the write-read cycle intact.

Attack Vector

An attacker with a low-privileged authenticated account submits crafted input containing a JavaScript payload into a vulnerable plugin field. The payload is stored in the WordPress wp_options or plugin-specific tables. When an administrator or shop manager subsequently loads the plugin settings or a page that renders the stored value, the script executes in their browser session. Attackers can use this primitive to steal authentication cookies, issue authenticated REST API requests, create new administrator accounts, or pivot to broader store compromise.

See the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2025-48251

Indicators of Compromise

• Plugin configuration fields containing <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
• Unexpected administrator or shop manager accounts created shortly after an authenticated user viewed plugin settings
• Outbound HTTP requests from admin browser sessions to unfamiliar domains carrying WordPress session cookies
• Modifications to WooCommerce email templates or recipient lists that do not correlate with legitimate admin activity

Detection Strategies

• Audit the wp_options table and plugin-specific tables for stored values containing HTML or script tokens
• Review WordPress activity logs for edits to custom email configuration by low-privileged accounts
• Inspect WooCommerce transactional email content for injected markup before dispatch
• Correlate admin browser telemetry with plugin settings page loads to identify script execution events

Monitoring Recommendations

• Enable a WordPress security plugin that logs option changes and user role modifications
• Forward web server access logs to a centralized log platform and alert on POST requests to plugin admin endpoints from non-administrator roles
• Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution in the WordPress admin

How to Mitigate CVE-2025-48251

Immediate Actions Required

• Update the Additional Custom Emails & Recipients for WooCommerce plugin to a version later than 3.5.1 as soon as a fixed release is available
• Restrict access to plugin configuration to trusted administrator accounts and audit existing role assignments
• Review all stored plugin configuration values and remove any entries containing HTML or JavaScript
• Rotate WordPress administrator credentials and invalidate active sessions if suspicious configuration entries are found

Patch Information

The Patchstack advisory identifies the vulnerable range as n/a through <= 3.5.1. Site owners should monitor the WPFactory plugin listing and the WordPress plugin repository for a patched release and apply it across all environments.

Workarounds

• Disable the Additional Custom Emails & Recipients for WooCommerce plugin until a patched version is installed
• Enforce a strict Content Security Policy in the WordPress admin to block inline script execution
• Deploy a virtual patching rule at the web application firewall that blocks script tokens in POST parameters targeting the plugin's admin endpoints
• Limit plugin configuration access to a small number of administrator accounts secured with multi-factor authentication

# Example WAF rule concept: block script tokens in plugin admin POST bodies
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=custom-emails-for-woocommerce" \
  "chain,deny,status:403,id:1004825,msg:'Blocked potential XSS payload in WPFactory plugin'"
  SecRule REQUEST_BODY "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none"