UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2025-5062

WooCommerce: Cross-site Scripting

Severity
Medium 6.1
Published
21 May 2025
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
9.3.4, 9.4.3
Also known as
EUVD-2025-16105, WPV-80a20c0ecbcc
Sources
NVD, WPVulnerability

Description

The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into…

Affected software

SoftwareAffected versions
WooCommerceServers and applications · cpe:a:woocommerce:woocommerce
  • Every version before 9.3.4
  • From 9.4.0 before 9.4.3
WooCommerceWordPress plugins · wp-plugin:woocommerce
  • Every version before 9.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-5062
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-5062
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce/woocommerce-942-postmessage-based-cross-site-scripting