CVE-2025-48254 Overview
CVE-2025-48254 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WPFactory Change Add to Cart Button Text for WooCommerce plugin (also known as add-to-cart-button-labels-for-woocommerce). The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with low privileges to inject persistent JavaScript payloads. Affected versions include all releases up to and including 2.2.2. Successful exploitation requires user interaction and can affect resources beyond the vulnerable component due to a scope change.
Critical Impact
An authenticated attacker with low privileges can store malicious scripts in the WooCommerce button label configuration, executing arbitrary JavaScript in the browsers of administrators or shoppers who view affected pages.
Affected Products
- WPFactory Change Add to Cart Button Text for WooCommerce (plugin slug: add-to-cart-button-labels-for-woocommerce)
- All versions from n/a through <= 2.2.2
- WordPress sites running WooCommerce with the vulnerable plugin installed
Discovery Timeline
- 2025-05-19 - CVE-2025-48254 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48254
Vulnerability Analysis
The vulnerability resides in the plugin's handling of custom button label text stored in WordPress. The plugin allows administrators and other privileged roles to configure custom "Add to Cart" button labels for WooCommerce products. Input submitted through these configuration fields is stored in the database and later rendered in product pages without adequate output encoding or input sanitization.
Because the payload persists in the database, every visitor who loads an affected product page triggers execution of attacker-controlled JavaScript. The scope change indicator means the injected script can act on resources outside the plugin's security boundary, such as the WordPress admin session.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress sanitization functions such as wp_kses(), sanitize_text_field(), or esc_html() to button label values before echoing them into HTML output. This omission allows raw HTML and <script> tags to be persisted and reflected verbatim to users.
Attack Vector
Exploitation proceeds over the network and requires an authenticated user with at least contributor-level privileges to submit a crafted button label containing JavaScript. A victim, typically a store administrator or a customer browsing product pages, must load a page that renders the malicious label. Once triggered, the payload runs in the victim's browser context and can be used to hijack sessions, exfiltrate cookies, perform forced administrative actions, or pivot to further compromise of the WordPress site.
The vulnerability is described in prose only; no verified public proof-of-concept code is available. See the Patchstack advisory for further technical detail.
Detection Methods for CVE-2025-48254
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes (for example, onerror, onload) stored in WooCommerce product metadata or plugin option rows in the wp_options and wp_postmeta tables.
- Outbound requests from browsers viewing product pages to unfamiliar third-party domains hosting JavaScript payloads.
- Newly created WordPress administrator accounts or unexpected privilege changes following administrator visits to the store.
Detection Strategies
- Audit plugin option values and product metadata for HTML tags or JavaScript syntax in fields that should contain only plain-text button labels.
- Deploy Web Application Firewall (WAF) rules to flag POST requests to WordPress admin endpoints that contain <script> or common XSS vector patterns targeting the plugin's settings pages.
- Review WordPress activity logs for label modifications made by low-privileged accounts.
Monitoring Recommendations
- Enable browser Content Security Policy (CSP) reporting to identify unexpected inline script execution on WooCommerce pages.
- Monitor endpoint telemetry on administrator workstations for signs of session token theft or unauthorized API calls to /wp-json/ following store visits.
- Track plugin version inventory across WordPress deployments to identify hosts running versions <= 2.2.2.
How to Mitigate CVE-2025-48254
Immediate Actions Required
- Update the Change Add to Cart Button Text for WooCommerce plugin to a version later than 2.2.2 as soon as a fixed release is available from WPFactory.
- Audit all button label configurations across products and remove any values containing HTML or scripting content.
- Rotate WordPress administrator passwords and invalidate active sessions if suspicious label content is discovered.
Patch Information
Refer to the Patchstack advisory for CVE-2025-48254 for the latest fix status and update guidance. Versions up to and including 2.2.2 are affected; administrators should upgrade to any subsequent patched release published by WPFactory.
Workarounds
- Deactivate and remove the plugin until a patched version is deployed if it is not business-critical.
- Restrict access to the plugin's settings page to trusted high-privilege accounts only, using role management controls.
- Deploy a WAF ruleset that blocks XSS payloads targeting WordPress plugin option endpoints, and enforce a strict Content Security Policy that disallows inline scripts on storefront pages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
