CVE-2025-60171: WooCommerce Cart Messages CSRF Vulnerability

CVE-2025-60171 Overview

CVE-2025-60171 is a Cross-Site Request Forgery (CSRF) vulnerability in the Conditional Cart Messages for WooCommerce plugin developed by YourPlugins.com. The flaw affects all plugin versions up to and including 1.2.10. An attacker can chain the CSRF flaw with Stored Cross-Site Scripting (XSS), allowing malicious JavaScript to be injected and persisted through forged administrative requests. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact

Successful exploitation lets attackers inject persistent JavaScript into WooCommerce store pages by tricking an authenticated administrator into clicking a crafted link, enabling session hijacking, content manipulation, or downstream account takeover.

Affected Products

• Conditional Cart Messages for WooCommerce – YourPlugins.com (yourplugins-wc-conditional-cart-notices)
• All versions from initial release through 1.2.10
• WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

• 2025-09-26 - CVE-2025-60171 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-60171

Vulnerability Analysis

The plugin processes state-changing requests without validating a CSRF token, also known as a WordPress nonce. An attacker hosts a malicious page or sends a crafted link that triggers a request to the plugin's administrative endpoint when an authenticated administrator visits it. Because the browser automatically attaches the administrator's session cookies, the WordPress backend processes the request as legitimate.

The submitted payload is then stored in the plugin's cart message configuration. When the message renders to site visitors or store administrators, the unsanitized input executes in their browsers as Stored XSS. This chains CSRF with XSS, allowing the attacker to bypass the same-origin protections that would normally block direct script injection.

The attack requires user interaction (UI:R) but no privileges (PR:N) on the attacker side, and the impact crosses a security boundary (S:C) because injected scripts execute in the context of every user who loads the affected page.

Root Cause

The plugin's request handlers fail to verify a valid wp_nonce or referrer header before persisting administrator-controlled input. Additionally, the input is not sanitized or output-encoded, enabling the XSS portion of the chain. Together these omissions violate WordPress plugin security guidance for handling privileged form submissions.

Attack Vector

Exploitation is network-based and requires an authenticated WordPress administrator to load attacker-controlled content while logged in. The attacker crafts an HTML form or image tag that auto-submits a POST request to the vulnerable plugin endpoint. The body contains a malicious cart notice value embedding <script> tags or event-handler attributes. Once stored, the payload fires for every shopper or admin viewing the cart context. See the Patchstack advisory for additional context.

Detection Methods for CVE-2025-60171

Indicators of Compromise

• Unexpected <script> tags, onerror, or onload attributes stored in the plugin's cart notice options inside the wp_options table
• WordPress access logs showing POST requests to plugin admin endpoints with external Referer headers
• New or modified administrator accounts created shortly after suspicious cart notice changes
• Browser console errors or content-security-policy violations triggered on cart, checkout, or product pages

Detection Strategies

• Audit the plugin configuration in wp_options for any cart notice fields containing HTML or JavaScript syntax
• Review WordPress audit logs for changes to plugin settings without a matching authenticated admin session in the UI
• Compare current plugin database values against a known-good backup to identify unauthorized modifications

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record settings changes with user, IP, and timestamp
• Forward web server logs to a SIEM and alert on POST requests to plugin admin pages with cross-origin referrers
• Monitor outbound traffic from store visitors for connections to unknown domains that may indicate XSS beaconing

How to Mitigate CVE-2025-60171

Immediate Actions Required

• Update the Conditional Cart Messages for WooCommerce plugin to a version newer than 1.2.10 once the vendor publishes a fix
• Temporarily deactivate the plugin if a patched release is not yet available and the cart message feature is non-essential
• Force a password reset and re-authentication for all WordPress administrator accounts
• Inspect and sanitize existing cart notice values to remove any stored script payloads

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.2.10. Administrators should consult the Patchstack vulnerability database entry and the vendor changelog for the corrected release version before upgrading.

Workarounds

• Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the plugin's admin endpoints lacking a same-origin Referer header
• Restrict WordPress admin access to known IP addresses through .htaccess or reverse-proxy ACLs
• Require administrators to use separate browsers or profiles for WordPress administration to limit cross-site request exposure
• Apply a strict Content Security Policy that disallows inline scripts on storefront pages

# Example nginx rule restricting wp-admin to a trusted CIDR range
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}