CVE-2025-5767: Crowdfunding for WooCommerce XSS Vulnerability

CVE-2025-5767 Overview

CVE-2025-5767 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Crowdfunding for WooCommerce plugin for WordPress. The flaw resides in the progress bar shortcode, specifically the width parameter, which fails to properly sanitize input or escape output. All plugin versions up to and including 3.1.14 are affected. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected page. The weakness is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent scripts that execute in the browsers of site visitors and administrators, enabling session theft, forced actions, and account compromise.

Affected Products

Crowdfunding for WooCommerce plugin for WordPress
All versions up to and including 3.1.14
WordPress sites using the plugin's progress bar shortcode

Discovery Timeline

2025-07-18 - CVE-2025-5767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5767

Vulnerability Analysis

The vulnerability exists in the plugin's progress bar shortcode handler located at includes/shortcodes/class-wc-crowdfunding-shortcodes-progress-bar.php. The width shortcode attribute is rendered directly into HTML output without sufficient sanitization or escaping. An authenticated user with Contributor privileges can embed a crafted shortcode inside post or page content. When the content is rendered, the injected payload executes in the context of any user viewing the page. Because the payload is stored in the WordPress database, exploitation persists across sessions and users, including site administrators.

Root Cause

The root cause is missing input validation and missing output escaping on the width shortcode parameter. WordPress provides functions such as esc_attr() and absint() for safely rendering numeric attribute values, but the vulnerable code path does not apply them before injecting the parameter into the rendered HTML.

Attack Vector

Exploitation requires an authenticated account with Contributor-level access or above. The attacker inserts the plugin's progress bar shortcode with a malicious width value containing HTML or JavaScript into a post or page. Once rendered, the script executes with the privileges of the viewing user. Successful exploitation can lead to session hijacking, unauthorized administrative actions, credential theft, and pivoting to full site takeover if an administrator views the affected page.

See the Wordfence Vulnerability Analysis and the WordPress Shortcode Class Code for the specific vulnerable code path.

Detection Methods for CVE-2025-5767

Indicators of Compromise

Post or page content containing the plugin's progress bar shortcode with unusual width values that include <, >, quotes, javascript:, or on*= event handler strings.
Unexpected <script> tags or inline event handlers appearing inside rendered progress bar HTML in the WordPress wp_posts table.
Contributor or Author accounts submitting or editing posts that contain crowdfunding shortcodes with non-numeric width parameters.

Detection Strategies

Query the WordPress wp_posts table for shortcode patterns matching the crowdfunding progress bar with malformed width attributes.
Review web server access logs for POST requests to post.php or the REST API /wp/v2/posts endpoint from Contributor accounts that contain suspicious shortcode payloads.
Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution on public pages.

Monitoring Recommendations

Monitor creation and modification of low-privilege user accounts, especially Contributor and Author roles.
Track plugin version inventory across WordPress sites and alert on installations running Crowdfunding for WooCommerce at 3.1.14 or earlier.
Log and review all shortcode-rendered HTML in newly published or edited content for injected script tags or event handlers.

How to Mitigate CVE-2025-5767

Immediate Actions Required

Update the Crowdfunding for WooCommerce plugin to a version later than 3.1.14 as soon as a patched release is available.
Audit existing posts and pages for the crowdfunding progress bar shortcode and remove or sanitize any suspicious width values.
Review Contributor and Author accounts, remove unused accounts, and reset credentials for any account showing suspicious activity.

Patch Information

Refer to the WordPress Plugin Developer Info page for the latest release notes and patched versions. The Wordfence Vulnerability Analysis tracks fix availability for this specific vulnerability.

Workarounds

Restrict Contributor-level and higher access to trusted users only until the plugin is patched.
Deploy a Web Application Firewall (WAF) rule to block requests containing shortcode payloads with HTML or script content in the width attribute.
Temporarily disable the Crowdfunding for WooCommerce plugin if the progress bar shortcode is not required for site operations.

bash

# Example: search WordPress database for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content REGEXP 'progress_bar[^]]*width=\"[^\"]*[<>\"]'"