Plattform
wordpress
Komponente
woocommerce
Behoben in
9.7.1
CVE-2025-26762 describes a Stored Cross-Site Scripting (XSS) vulnerability within the WooCommerce e-commerce plugin. This vulnerability allows attackers to inject malicious scripts that are stored on the server and executed when other users access affected pages. Versions of WooCommerce from 0.0.0 up to and including 9.7.0 are affected, and a fix is available in version 9.7.1.
Successful exploitation of this XSS vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to a variety of malicious actions, including session hijacking, credential theft (e.g., stealing login cookies), redirection to phishing sites, and defacement of the website. The stored nature of the vulnerability means that a single successful injection can affect numerous users who subsequently view the compromised page. The impact is amplified in environments with high user traffic or sensitive data processing.
CVE-2025-26762 was published on March 27, 2025. As of this writing, there are no publicly available exploits or reports of active exploitation campaigns. The vulnerability is not currently listed on KEV or EPSS, suggesting a low to medium probability of exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Exploit-Status
EPSS
0.07% (22% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-26762 is to immediately upgrade WooCommerce to version 9.7.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict input validation and output encoding on user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a layer of protection. Regularly scan your WooCommerce installation for vulnerabilities using a reputable security scanner.
Actualice el plugin WooCommerce a la última versión disponible para mitigar la vulnerabilidad de XSS. Verifique la disponibilidad de actualizaciones en el panel de administración de WordPress o a través del repositorio oficial de plugins de WordPress. Implemente medidas de seguridad adicionales, como la validación y el saneamiento de las entradas del usuario, para prevenir futuros ataques XSS.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-26762 is a Medium severity vulnerability in WooCommerce allowing attackers to inject malicious scripts stored on the server. This can lead to session hijacking and data theft, affecting versions 0.0.0–9.7.0.
Yes, if you are using WooCommerce versions 0.0.0 through 9.7.0, you are potentially affected by this Stored XSS vulnerability. Immediately check your version and upgrade if necessary.
Upgrade WooCommerce to version 9.7.1 or later to resolve this vulnerability. If immediate upgrade is impossible, implement temporary mitigations like input validation and WAF rules.
As of now, there are no publicly known active exploitation campaigns or readily available exploits for CVE-2025-26762, but vigilance is still advised.
Refer to the official WooCommerce security advisory for detailed information and updates regarding CVE-2025-26762: [https://woocommerce.com/security/](https://woocommerce.com/security/)
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.