CVE-2025-58985: WooCommerce Product Tabs Stored XSS Flaw

CVE-2025-58985 Overview

CVE-2025-58985 is a stored cross-site scripting (XSS) vulnerability in the WPFactory Additional Custom Product Tabs for WooCommerce plugin. The flaw affects all plugin versions up to and including 1.7.3. An authenticated attacker with low privileges can inject malicious script content that persists in product tab data and executes in the browsers of users who view affected pages. The issue is classified under CWE-79 for improper neutralization of input during web page generation. Successful exploitation requires user interaction and can pivot into session theft, administrative account takeover, or WooCommerce storefront defacement.

Critical Impact
Authenticated attackers can store JavaScript payloads inside WooCommerce product tabs, executing arbitrary script in the context of shoppers and administrators who load the affected product pages.

Affected Products

WPFactory Additional Custom Product Tabs for WooCommerce (product-tabs-for-woocommerce) plugin
All versions from initial release through 1.7.3
WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

2025-09-09 - CVE-2025-58985 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58985

Vulnerability Analysis

The plugin adds custom product tabs to WooCommerce product pages, letting merchants define tab titles and rich content per product. The vulnerable code path fails to properly neutralize input supplied when creating or editing these custom tabs. Attacker-controlled markup is stored in the database and later rendered without adequate output encoding, producing a stored XSS condition.

Because the payload persists in product metadata, every visitor loading the affected product page triggers the script. In WooCommerce environments this typically includes shop administrators reviewing orders and customer-facing traffic, which broadens the population exposed to a single injection. The scope-changed nature of the flaw indicates the injected script can affect content controlled outside the vulnerable component, such as adjacent WordPress admin views.

Root Cause

The root cause is missing or insufficient sanitization and escaping of user-supplied tab content. The plugin trusts input from privileged users who can manage products, but does not enforce a strict allow-list on HTML or escape output using functions such as esc_html(), esc_attr(), or wp_kses_post() where appropriate. Improper neutralization of input during web page generation is the underlying weakness ([CWE-79]).

Attack Vector

Exploitation requires an authenticated user with permission to create or edit WooCommerce products, such as a Shop Manager or contributor-level role granted product editing rights. The attacker crafts a product tab whose title or body contains JavaScript, saves the product, and waits for another user to visit the product page or the admin product editor. Because the vulnerability is network-reachable and requires only low privileges and a single user interaction, it is well suited for privilege escalation from Shop Manager to full administrator via cookie theft or forced admin actions. See the Patchstack Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-58985

Indicators of Compromise

Product tab titles or body content containing <script>, onerror=, onload=, or javascript: strings in the wp_postmeta table
Unexpected outbound requests from admin browsers to attacker-controlled domains shortly after visiting product edit pages
New administrator accounts, altered user roles, or modified WordPress options following product edits by low-privileged staff
Web server logs showing product edit POST requests from unusual accounts or IP addresses

Detection Strategies

Query the WordPress database for product meta entries associated with the plugin that contain HTML event handlers or <script> tags
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to WooCommerce product endpoints for script payloads
Enable WordPress audit logging to capture who edited which products and when, correlating with subsequent privilege changes

Monitoring Recommendations

Monitor for creation of administrator accounts and modifications to wp_users and wp_usermeta following product edits
Alert on browser telemetry showing script execution from /wp-admin/post.php or single-product pages loading external JavaScript
Track plugin version inventory across WordPress estates and flag any host still running product-tabs-for-woocommerce at version 1.7.3 or earlier

How to Mitigate CVE-2025-58985

Immediate Actions Required

Identify all WordPress sites running the Additional Custom Product Tabs for WooCommerce plugin and confirm installed versions
Update the plugin to a version later than 1.7.3 once the vendor publishes a fix, or deactivate and remove the plugin if no patch is available
Audit existing product tabs for injected HTML or JavaScript and remove any suspicious content before restoring normal operations
Rotate credentials and session tokens for administrators who may have loaded affected product pages

Patch Information

At the time of the NVD entry, the advisory lists all versions through 1.7.3 as affected and does not identify a fixed release. Consult the Patchstack Vulnerability Advisory and the WPFactory changelog for the current fixed version before deploying updates.

Workarounds

Restrict product editing permissions to a minimal set of trusted administrators until a patched version is installed
Deploy a virtual patch via WAF rules that block HTML tags and JavaScript event handlers in product tab fields
Enforce a strict Content Security Policy (CSP) on the WooCommerce storefront and /wp-admin/ to limit inline script execution
Temporarily disable the plugin on production sites if patching cannot be completed in a reasonable window

bash

# Configuration example: locate vulnerable installations via WP-CLI
wp plugin list --format=csv | grep product-tabs-for-woocommerce
wp plugin deactivate product-tabs-for-woocommerce
# After vendor releases a fix:
wp plugin update product-tabs-for-woocommerce