CVE-2025-54749: JetProductGallery Stored XSS Vulnerability

CVE-2025-54749 Overview

CVE-2025-54749 is a stored Cross-Site Scripting (XSS) vulnerability in the Crocoblock JetProductGallery WordPress plugin (jet-woo-product-gallery). The flaw affects all versions up to and including 2.2.0.2. Authenticated contributors can inject malicious scripts that execute in the browsers of site visitors and administrators who view affected pages. The issue is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact

A low-privileged authenticated attacker can store JavaScript payloads that execute in the context of other users, enabling session theft, account takeover, and administrative action hijacking within WooCommerce storefronts.

Affected Products

• Crocoblock JetProductGallery plugin for WordPress
• All versions from n/a through 2.2.0.2
• WooCommerce sites using the plugin for product gallery rendering

Discovery Timeline

• 2025-08-14 - CVE-2025-54749 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54749

Vulnerability Analysis

The JetProductGallery plugin fails to properly sanitize and escape user-supplied input before rendering it in the WordPress front-end. An attacker with at least contributor-level privileges can inject HTML and JavaScript through plugin fields that are later reflected without adequate output encoding. Because the payload is persisted in the WordPress database, every subsequent visitor loading the affected product gallery page executes the malicious script.

Exploitation requires user interaction, and the impact crosses a security boundary (scope change) because scripts execute in the browser trust context of the WordPress site. This allows attackers to reach session cookies, CSRF tokens, and admin interfaces that are otherwise isolated from the attacker's own account.

Root Cause

The root cause is missing or insufficient use of WordPress escaping functions such as esc_html(), esc_attr(), and wp_kses() on inputs handled by the plugin. Content stored through the plugin's product gallery configuration is rendered directly into the page markup, allowing HTML tags and inline event handlers to survive persistence and reach the DOM.

Attack Vector

The attack vector is network-based and requires an authenticated account with content creation privileges on the target WordPress site. The attacker supplies a crafted string containing JavaScript into a vulnerable plugin field. The payload is stored and later executed when an administrator or customer loads a page that renders the affected gallery output. The vulnerability manifests when the plugin outputs stored content without escaping. See the Patchstack WordPress Plugin Advisory for technical details on the affected sinks.

Detection Methods for CVE-2025-54749

Indicators of Compromise

• Unexpected <script> tags, onerror=, onload=, or javascript: URIs stored in wp_postmeta or wp_options rows related to the JetProductGallery plugin.
• Outbound requests from administrator browsers to unfamiliar domains shortly after visiting product gallery pages.
• New administrator accounts or modified user roles appearing without change-control records.
• Anomalous WooCommerce product edits performed by contributor-level accounts.

Detection Strategies

• Query the WordPress database for HTML control characters in fields owned by jet-woo-product-gallery and alert on payloads containing script or event-handler patterns.
• Monitor web server access logs for POST requests to admin-ajax.php and REST endpoints tied to the plugin from low-privilege accounts.
• Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from affected gallery pages.

Monitoring Recommendations

• Enable file integrity monitoring for the plugin directory wp-content/plugins/jet-woo-product-gallery/.
• Audit contributor and author accounts for suspicious activity and enforce multi-factor authentication.
• Forward WordPress and web server logs to a central analytics platform to correlate authentication events with plugin activity.

How to Mitigate CVE-2025-54749

Immediate Actions Required

• Update the JetProductGallery plugin to a version later than 2.2.0.2 as soon as the vendor publishes a fixed release.
• Review and remove any suspicious gallery entries or metadata created by non-administrative users.
• Rotate administrator session cookies and passwords if exploitation is suspected.
• Restrict contributor and author registration to trusted users only.

Patch Information

Refer to the Patchstack WordPress Plugin Advisory for the current patch status. Administrators should subscribe to Crocoblock security notifications and apply the fixed version through the WordPress plugin updater once released.

Workarounds

• Temporarily deactivate the JetProductGallery plugin until a patched version is installed.
• Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or event-handler attributes destined for plugin endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts to reduce exploitability.
• Limit editorial roles and require code review for user-submitted product gallery content.

# Configuration example: enforce a restrictive CSP via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"