CVE-2025-57967: WPB Quick View WooCommerce XSS Vulnerability

CVE-2025-57967 Overview

CVE-2025-57967 is a stored cross-site scripting (XSS) vulnerability in the WPBean WPB Quick View for WooCommerce plugin (woocommerce-lightbox) for WordPress. The flaw affects all versions up to and including 2.1.8. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The issue is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions in the context of any user, including administrators, who load the injected content.

Affected Products

WPBean WPB Quick View for WooCommerce (woocommerce-lightbox) versions up to and including 2.1.8
WordPress sites running WooCommerce with the vulnerable plugin activated
Administrator and customer-facing storefront pages that render plugin-controlled content

Discovery Timeline

2025-09-22 - CVE-2025-57967 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57967

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the WPB Quick View for WooCommerce plugin. The plugin renders attacker-controlled input into HTML output without adequate sanitization or output encoding. Because the payload is stored server-side, every subsequent visitor who loads the affected view triggers script execution in their own browser session. Exploitation requires low-privilege authentication and user interaction, and the scope changes when the payload executes across contexts. Successful exploitation can lead to session token theft, forced administrative actions via forged requests, redirection to attacker infrastructure, and delivery of secondary payloads such as browser exploits or phishing overlays.

Root Cause

The root cause is a failure to apply WordPress sanitization primitives such as sanitize_text_field(), wp_kses_post(), or esc_attr() and esc_html() on input flowing through plugin-controlled fields before it is written to the database and later echoed into the rendered page. The absence of contextual output encoding allows raw HTML and <script> payloads to persist and execute.

Attack Vector

An attacker authenticated as a low-privilege user submits crafted input to a plugin-managed field that stores product quick-view content or associated metadata. The payload remains in the database. When a victim, including a site administrator, subsequently loads a page that renders the stored content, the injected JavaScript executes in the victim's browser under the site origin. See the Patchstack advisory for additional technical details.

Detection Methods for CVE-2025-57967

Indicators of Compromise

Presence of <script>, onerror=, onload=, or javascript: sequences in WooCommerce product metadata, quick-view fields, or plugin option tables
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening a product quick-view page
New or modified WordPress administrator accounts created without a corresponding audit trail
Injected <iframe> or redirect logic embedded in product descriptions rendered by the plugin

Detection Strategies

Audit database rows in wp_postmeta and plugin-specific option tables for HTML event handlers and script tags
Review web server access logs for POST requests to plugin AJAX endpoints containing encoded script payloads
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from stored content
Use a web application firewall with signatures for stored XSS payloads targeting WordPress plugins

Monitoring Recommendations

Alert on modifications to WordPress user roles, capabilities, and administrator account creation events
Monitor plugin update status and flag installations still running woocommerce-lightbox version 2.1.8 or earlier
Track anomalous session activity such as administrator logins followed by rapid privilege changes

How to Mitigate CVE-2025-57967

Immediate Actions Required

Update WPB Quick View for WooCommerce to a version later than 2.1.8 as soon as a fixed release is published by WPBean
Restrict contributor and editor roles from creating or editing product content until the plugin is patched
Rotate credentials and invalidate active sessions for any account that may have interacted with attacker-controlled content
Scan all product metadata for stored payloads and remove injected HTML or JavaScript

Patch Information

Refer to the Patchstack advisory for woocommerce-lightbox for vendor patch status. Apply the fixed release from WPBean through the WordPress plugin repository once available. Validate the installed version using wp plugin list --name=woocommerce-lightbox after the update.

Workarounds

Deactivate and remove the WPB Quick View for WooCommerce plugin until a patched version is installed
Deploy a WAF rule that blocks HTML event handlers and script tags in requests to plugin endpoints
Enforce a strict Content Security Policy that disallows inline script execution on storefront and administrator pages

bash

# Configuration example
# Disable the vulnerable plugin using WP-CLI until a patched release is deployed
wp plugin deactivate woocommerce-lightbox
wp plugin list --name=woocommerce-lightbox --fields=name,status,version

# Example nginx header enforcing a restrictive Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';" always;