CVE-2025-8618: WPC Smart Quick View WooCommerce XSS Flaw

CVE-2025-8618 Overview

CVE-2025-8618 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPC Smart Quick View for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.2.1. It resides in the plugin's woosq_btn shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page, enabling session theft, redirection, or unauthorized actions performed in the victim's context [CWE-79].

Critical Impact
Contributor-level accounts can persist arbitrary JavaScript in WordPress pages, causing script execution against every user who views the injected content.

Affected Products

WPC Smart Quick View for WooCommerce plugin for WordPress
All versions up to and including 4.2.1
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-08-20 - CVE-2025-8618 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8618

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw introduced through the woosq_btn shortcode handler. WordPress shortcodes accept attributes that authors can embed within post and page content. The plugin renders these attributes into HTML output without adequate sanitization or escaping. A contributor who authors a post containing the shortcode can supply attribute values that break out of the intended HTML context and execute JavaScript. Because the payload is persisted with the post content, it fires each time the page is rendered, extending the impact to all visitors including administrators.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode's attribute-handling code path. The plugin should apply functions such as sanitize_text_field() on input and esc_attr() or esc_html() on output. See the WordPress Plugin Code Review for the affected line and the WordPress Changeset Update applying the fix.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker embeds the woosq_btn shortcode into a post or page and supplies a malicious value for one of its attributes. When an administrator, editor, or site visitor loads that page, the browser parses and executes the injected script. Because the vulnerability spans a scope change from contributor to viewer, it can be leveraged for privilege escalation via session hijacking or forced administrative actions.

No verified public proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-8618

Indicators of Compromise

Presence of the woosq_btn shortcode with attribute values containing HTML tags, <script> markers, on*= event handlers, or javascript: URIs
Post revisions authored by contributor-level accounts that include unexpected HTML entities within shortcode attributes
Unexpected outbound HTTP requests from browsers loading WordPress pages containing the affected shortcode
WordPress wp_posts rows where post_content contains encoded script payloads inside [woosq_btn ...]

Detection Strategies

Query the WordPress database for post_content matching the woosq_btn shortcode and inspect attribute values for HTML control characters
Monitor Content Security Policy (CSP) violation reports for inline script or external script violations originating from WordPress-rendered pages
Review web server logs for unusual POST requests to wp-admin/post.php from contributor accounts adding or editing content with the shortcode

Monitoring Recommendations

Enable audit logging on the WordPress site to track post creation and modification events by low-privileged users
Alert on new contributor account creation and on privilege changes shortly after content edits
Correlate administrator session activity with visits to pages containing the affected shortcode to identify potential session hijacking

How to Mitigate CVE-2025-8618

Immediate Actions Required

Update the WPC Smart Quick View for WooCommerce plugin to a version newer than 4.2.1 that includes the fix from changeset 3346074
Audit existing posts and pages for the woosq_btn shortcode and remove any attributes containing script payloads or unexpected HTML
Review contributor-level accounts and revoke access for accounts that are unused or unrecognized

Patch Information

The vendor released a fix documented in the WordPress plugin repository changeset. Site administrators should upgrade through the WordPress plugin dashboard or download the latest version directly from the Woo Smart Quick View Plugin page. Verify that the installed version is greater than 4.2.1 after the update completes.

Workarounds

Restrict the contributor role from using the woosq_btn shortcode by filtering do_shortcode for lower-privileged authors
Deploy a Web Application Firewall (WAF) rule that blocks requests containing shortcode attributes with HTML tags or JavaScript keywords
Implement a strict Content Security Policy (CSP) that disallows inline scripts on the WordPress front end
Temporarily deactivate the plugin until the patched version is deployed

bash

# Example: WP-CLI command to locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[woosq_btn%' AND post_status IN ('publish','draft','pending');"

# Example: force-update the plugin via WP-CLI
wp plugin update woo-smart-quick-view