CVE-2025-7496: WPC Smart Compare for WooCommerce XSS Vulnerability

CVE-2025-7496 Overview

CVE-2025-7496 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPC Smart Compare for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 6.4.7. It stems from insufficient input sanitization and output escaping of data rendered through DOM elements.

Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users visit affected pages. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated Contributor can store malicious JavaScript that executes in the browser context of any visitor, including administrators, enabling session theft, admin account takeover, and site defacement.

Affected Products

WPC Smart Compare for WooCommerce plugin for WordPress
All versions up to and including 6.4.7
WordPress sites allowing Contributor-level or higher registration

Discovery Timeline

2025-08-19 - CVE-2025-7496 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7496

Vulnerability Analysis

The WPC Smart Compare for WooCommerce plugin renders user-controlled data into DOM elements without applying adequate sanitization or output escaping. When a Contributor-level user supplies crafted input through plugin-exposed fields, the payload is stored in the WordPress database. The payload is later rendered in the browser DOM of any user who accesses a page containing the injected content.

Because the attack is stored rather than reflected, exploitation does not require social engineering of individual victims. Any administrator who previews a Contributor's draft, or any visitor who loads a compromised product page, triggers the payload. Successful exploitation can lead to session cookie theft, forced administrative actions through the WordPress REST API, and persistent backdoor installation via plugin or theme editing.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render. WordPress provides functions such as sanitize_text_field(), wp_kses_post(), and esc_html() for these operations. The affected plugin paths accept input and emit it into DOM contexts without invoking the appropriate neutralization routines, allowing HTML and script content to pass through intact.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. The attacker authenticates to WordPress as a Contributor or higher, submits content containing a crafted script payload through a plugin-handled field, and waits for a privileged user or site visitor to render the stored content. The scope is changed because the executed script runs in the WordPress origin and can act on behalf of the viewing user.

No verified proof-of-concept exploit code has been published. For detailed technical context, see the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2025-7496

Indicators of Compromise

WordPress posts, product entries, or plugin option values containing <script>, onerror=, onload=, or javascript: substrings submitted by Contributor-level accounts.
Unexpected creation of administrator accounts or modification of WordPress user roles shortly after Contributor content is published.
Outbound browser requests from logged-in administrators to unfamiliar domains when viewing product compare pages.

Detection Strategies

Audit the wp_posts, wp_postmeta, and plugin-specific tables for HTML event handlers or script tags in fields rendered by the compare plugin.
Monitor WordPress audit logs for Contributor accounts submitting unusually large or encoded payloads to compare-related endpoints.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from stored content.

Monitoring Recommendations

Enable WordPress activity logging to track Contributor publishing events and administrator page previews.
Alert on new user registrations assigned the Administrator role or on changes to the wp_users and wp_usermeta tables.
Track access-log patterns to /wp-admin/post.php and compare-plugin AJAX endpoints originating from low-privilege accounts.

How to Mitigate CVE-2025-7496

Immediate Actions Required

Update the WPC Smart Compare for WooCommerce plugin to the version that remediates CVE-2025-7496 as published in the plugin changeset.
Review all Contributor and Author accounts and remove or downgrade any that are not required for site operation.
Scrub existing posts, product entries, and plugin options for stored script payloads before restoring normal publishing workflows.

Patch Information

The vendor addressed the issue in a release following 6.4.7. Review the WordPress Plugin Change Log for the specific fixed version and apply the update through the WordPress plugin administration interface.

Workarounds

Disable the WPC Smart Compare for WooCommerce plugin until the patched version is deployed.
Restrict Contributor-level registration and require administrator approval for new accounts.
Deploy a web application firewall rule that blocks script tags and HTML event handlers in POST parameters targeting compare-plugin endpoints.

bash

# Update the plugin via WP-CLI
wp plugin update woo-smart-compare

# Audit low-privilege accounts
wp user list --role=contributor --fields=ID,user_login,user_registered

# Temporarily deactivate the plugin
wp plugin deactivate woo-smart-compare