CVE-2025-60173: GST for WooCommerce CSRF Vulnerability

CVE-2025-60173 Overview

CVE-2025-60173 is a Cross-Site Request Forgery (CSRF) vulnerability in the GST for WooCommerce WordPress plugin developed by Ashwani Kumar. This vulnerability allows attackers to leverage CSRF attacks to inject and execute Stored Cross-Site Scripting (XSS) payloads. The chained CSRF-to-Stored-XSS attack pattern significantly increases the impact, as malicious scripts persist in the application and execute whenever users access the affected pages.

Critical Impact

Attackers can exploit this CSRF vulnerability to inject persistent XSS payloads, potentially leading to session hijacking, credential theft, administrative account compromise, and unauthorized actions on behalf of authenticated users in WooCommerce stores.

Affected Products

• GST for WooCommerce plugin versions from n/a through 2.0
• WordPress installations running the vulnerable gst-for-woocommerce plugin
• WooCommerce stores utilizing GST calculation functionality

Discovery Timeline

• 2025-09-26 - CVE CVE-2025-60173 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-60173

Vulnerability Analysis

This vulnerability represents a classic CSRF-to-Stored-XSS attack chain commonly found in WordPress plugins that fail to implement proper security controls. The GST for WooCommerce plugin lacks adequate CSRF token validation on form submissions that handle user-controllable input. When combined with insufficient output encoding, this creates a pathway for attackers to inject malicious JavaScript that persists in the database and executes in the browsers of other users.

The attack requires user interaction—specifically, an authenticated administrator must be tricked into visiting a malicious page or clicking a crafted link. Once this occurs, the attacker's payload is submitted without proper authorization checks, and the stored XSS payload executes whenever the compromised page is rendered.

Root Cause

The root cause of CVE-2025-60173 lies in two interrelated security failures within the plugin:

1. Missing or Improper CSRF Protection (CWE-352): The plugin does not properly implement WordPress nonce verification for state-changing operations. Forms that modify plugin settings or store user input fail to validate that requests originate from legitimate user sessions.

2. Insufficient Input Sanitization and Output Encoding: Input fields processed by the plugin do not adequately sanitize user-supplied data before storage, and output is not properly escaped when rendered, allowing script execution in the browser context.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious HTML page containing a hidden form that targets the vulnerable endpoint in the GST for WooCommerce plugin. The form auto-submits via JavaScript when an authenticated WordPress administrator visits the page.

The attack flow proceeds as follows:

1. The attacker identifies the vulnerable form action endpoint in the plugin
2. A malicious page is crafted containing a hidden form with XSS payload in input fields
3. The attacker tricks an authenticated administrator into visiting the malicious page
4. The form auto-submits, bypassing CSRF protections due to missing nonce validation
5. The XSS payload is stored in the WordPress database
6. When any user (including administrators) views the affected page, the malicious script executes

Since no verified code examples are available for this vulnerability, technical implementation details can be found in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-60173

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in GST plugin settings or database entries
• Suspicious external resource requests originating from WooCommerce admin pages
• Browser console errors indicating blocked cross-origin script execution attempts
• Unusual administrator account activity or session token theft indicators

Detection Strategies

• Review WordPress database tables associated with the GST for WooCommerce plugin for stored XSS payloads
• Monitor server access logs for unusual POST requests to plugin endpoints from external referrers
• Implement Web Application Firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugins
• Use browser-based XSS detection tools during security audits of WooCommerce installations

Monitoring Recommendations

• Enable WordPress security logging plugins to track administrative actions and form submissions
• Configure Content Security Policy (CSP) headers to restrict script execution sources
• Monitor for outbound connections from WordPress admin pages to untrusted domains
• Implement integrity monitoring for plugin configuration values stored in the database

How to Mitigate CVE-2025-60173

Immediate Actions Required

• Update the GST for WooCommerce plugin to a version newer than 2.0 when a patched release becomes available
• Temporarily deactivate the gst-for-woocommerce plugin if it is not critical to store operations
• Review and audit any stored data in plugin settings for suspicious JavaScript code
• Implement a Web Application Firewall (WAF) with CSRF and XSS protection rules

Patch Information

Refer to the plugin developer or the Patchstack WordPress Vulnerability Report for official patch information. Ensure the plugin is updated to a version that properly implements WordPress nonce verification and input sanitization.

Workarounds

• Deactivate the GST for WooCommerce plugin until a patched version is available
• Implement restrictive Content Security Policy headers to mitigate XSS execution impact
• Limit WordPress admin access to trusted IP addresses using .htaccess or server firewall rules
• Train administrators to avoid clicking suspicious links or visiting untrusted sites while authenticated

# Example: Add Content Security Policy header in Apache .htaccess
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"
</IfModule>