CVE-2025-5285: WooCommerce Product Subtitle XSS Flaw

CVE-2025-5285 Overview

CVE-2025-5285 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Product Subtitle for WooCommerce plugin for WordPress. The flaw exists in all plugin versions up to and including 1.3.9. It stems from insufficient input sanitization and output escaping on the htmlTag parameter within the plugin's Gutenberg block handler. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user viewing the affected page, enabling session theft, account takeover, or redirection to attacker-controlled resources.

Critical Impact
Authenticated Contributor-level users can persist arbitrary JavaScript in WooCommerce product pages, leading to session hijacking and privilege escalation against site administrators.

Affected Products

Product Subtitle for WooCommerce plugin for WordPress — versions up to and including 1.3.9
WordPress sites running WooCommerce with the affected plugin installed
Any authenticated user role at Contributor level or above on the vulnerable site

Discovery Timeline

2025-05-31 - CVE-2025-5285 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5285

Vulnerability Analysis

The vulnerability is classified as Stored Cross-Site Scripting under CWE-79. It resides in the plugin's Gutenberg block implementation, specifically in class-pswc-guternburg-block.php where the htmlTag attribute is rendered into product page output. The plugin accepts the htmlTag value from block attributes and echoes it back without applying WordPress sanitization functions such as sanitize_key() or tag_escape(). Because the output is stored in post content, the payload persists across sessions and executes whenever the page is loaded.

Exploitation requires only Contributor privileges, which is a low bar on multi-author WordPress sites accepting guest contributors. The scope-changed nature of the vulnerability means the injected script executes in the context of higher-privileged users such as Editors or Administrators reviewing the content.

Root Cause

The root cause is missing input sanitization on block attribute values and missing output escaping when rendering the HTML tag. WordPress provides tag_escape() for exactly this purpose, but the vulnerable render callback concatenates the attacker-controlled value directly into markup. See the WordPress Gutenberg block code for the affected implementation.

Attack Vector

An authenticated attacker with Contributor-or-higher access opens the block editor and inserts a Product Subtitle block. The attacker manipulates the htmlTag block attribute — either through the editor UI or by sending a crafted REST API request to /wp-json/wp/v2/posts — to include an HTML fragment containing a JavaScript event handler such as onmouseover or onerror. Upon page render, the payload is emitted into the DOM and executed by every visitor's browser.

The vulnerability requires no user interaction beyond navigating to the poisoned page. See the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2025-5285

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs within product subtitle block markup stored in the wp_posts table.
Anomalous outbound requests from browsers viewing WooCommerce product pages to unfamiliar third-party domains.
New administrator accounts, plugin installations, or user role changes created shortly after Contributor accounts edited product content.

Detection Strategies

Audit wp_posts.post_content for the wp:product-subtitle-for-woocommerce block and inspect htmlTag attribute values for non-alphanumeric content.
Monitor WordPress REST API traffic for POST and PUT requests to post endpoints containing suspicious HTML characters in block attributes.
Review recent Contributor and Author activity in audit logs, correlating post revisions with subsequent unusual administrative actions.

Monitoring Recommendations

Enable a WordPress security plugin that logs post revisions and block attribute changes with user attribution.
Deploy a web application firewall (WAF) with rules that inspect request bodies for XSS payloads targeting Gutenberg block attributes.
Aggregate web server access logs into a centralized analytics or SIEM platform and alert on abnormal script-source domains referenced in product page HTML.

How to Mitigate CVE-2025-5285

Immediate Actions Required

Update the Product Subtitle for WooCommerce plugin to the latest version available on the WordPress plugin developer page.
Audit all existing product subtitle blocks for injected payloads and remove suspicious content before restoring the plugin to service.
Review Contributor, Author, and Editor accounts, disabling any that are unused or unrecognized.

Patch Information

The vendor addressed the flaw in a version subsequent to 1.3.9. Refer to the WordPress plugin changeset for the code change and the Wordfence vulnerability report for the fixed release notes. Administrators should apply the update through the WordPress plugin management interface and confirm the installed version reflects the patched release.

Workarounds

Deactivate the Product Subtitle for WooCommerce plugin until the patched version is installed if immediate updating is not feasible.
Restrict Contributor-level and above account creation, and require multi-factor authentication for all content authoring roles.
Deploy WAF rules that block requests containing HTML event handler attributes or <script> tags in Gutenberg block attribute payloads.

bash

# Configuration example: WP-CLI commands to inventory and update the affected plugin
wp plugin list --name=product-subtitle-for-woocommerce --fields=name,status,version
wp plugin update product-subtitle-for-woocommerce
wp plugin deactivate product-subtitle-for-woocommerce   # if patch not yet available