CVE-2025-64289 Overview
CVE-2025-64289 is a stored cross-site scripting (XSS) vulnerability in the Premmerce Product Search for WooCommerce WordPress plugin. The flaw affects all plugin versions up to and including 2.2.5. It stems from improper neutralization of user-supplied input during web page generation, categorized under [CWE-79].
An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The scope change indicated by the CVSS vector shows impact extends beyond the vulnerable component to other browser contexts.
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative action forgery against WooCommerce store operators and shoppers viewing affected pages.
Affected Products
- Premmerce Product Search for WooCommerce plugin (premmerce-search)
- All versions from initial release through 2.2.5
- WordPress sites running WooCommerce with the vulnerable plugin installed
Discovery Timeline
- 2025-10-29 - CVE-2025-64289 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64289
Vulnerability Analysis
The vulnerability resides in the input handling logic of the Premmerce Product Search plugin for WooCommerce. The plugin fails to sanitize or encode user-controlled input before storing it and later rendering it inside HTML output. This allows attacker-supplied markup and script content to persist in the database.
When a victim loads a page that renders the stored value, the browser parses the injected payload as active content. Attack payloads execute with the origin and session context of the WordPress site.
Exploitation requires an authenticated session with high privileges and user interaction from a victim. Successful exploitation yields limited confidentiality, integrity, and availability impact, but the scope change extends effects beyond the vulnerable component.
Root Cause
The plugin does not apply WordPress sanitization primitives such as sanitize_text_field(), wp_kses(), or esc_html() on input before persistence and rendering. Output routines emit stored values directly into HTML contexts without escaping, allowing <script> tags and event handler attributes to survive to the browser.
Attack Vector
An attacker with elevated plugin access submits a crafted payload through a plugin-controlled input field. The malicious content is stored in the WordPress database. When an administrator or another privileged user opens the affected view, the payload executes in their browser session.
Typical post-exploitation actions include stealing authentication cookies, submitting requests as the victim, exfiltrating store data, or pivoting to inject further backdoors via the WordPress admin interface. See the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-64289
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or on*= event handler attributes stored in WordPress wp_options, wp_postmeta, or plugin-specific tables
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WooCommerce admin pages
- New or modified administrator accounts and unexpected plugin installations following visits to search-related plugin pages
Detection Strategies
- Query the database for stored plugin values containing HTML tags, angle brackets, or common XSS keywords such as onerror, onload, or document.cookie
- Review web server logs for POST requests to plugin endpoints containing encoded script payloads or unusual Unicode escapes
- Correlate WordPress audit logs with browser-side Content Security Policy (CSP) violation reports if CSP is configured
Monitoring Recommendations
- Enable and centrally collect WordPress activity logs to track privileged user actions on plugin configuration pages
- Monitor administrator session behavior for anomalous API calls, especially account creation and file uploads
- Alert on plugin file modifications and unexpected changes to WooCommerce product metadata
How to Mitigate CVE-2025-64289
Immediate Actions Required
- Identify all WordPress sites running the Premmerce Product Search for WooCommerce plugin at version 2.2.5 or earlier
- Update the plugin to a patched release once made available by Premmerce, referencing the Patchstack Vulnerability Report
- Audit stored plugin data and remove any injected HTML or script content from the database
- Rotate administrator credentials and invalidate active WordPress sessions if compromise is suspected
Patch Information
At time of publication, the advisory identifies affected versions through 2.2.5 with no fixed version confirmed in the referenced source. Site operators should monitor the plugin's WordPress.org listing and the Patchstack advisory for the fixed release and apply it immediately upon availability.
Workarounds
- Deactivate and remove the Premmerce Product Search for WooCommerce plugin until a patched version is installed
- Restrict plugin administration capabilities to a minimal set of trusted accounts protected by multi-factor authentication
- Deploy a web application firewall (WAF) rule to block requests containing script tags or event handler attributes targeting plugin endpoints
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and storefront pages
# Deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate premmerce-search
wp plugin delete premmerce-search
# Verify no residual plugin files remain
find wp-content/plugins -maxdepth 1 -name 'premmerce-search*'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
