CVE-2025-12398
📋 TL;DR
The Product Table for WooCommerce WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in the 'search_key' parameter. Unauthenticated attackers can inject malicious scripts that execute when users click specially crafted links, potentially stealing session cookies or redirecting users. All WordPress sites using this plugin up to version 5.0.8 are affected.
💻 Affected Systems
- Product Table for WooCommerce WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain administrative access to WordPress, install backdoors, deface websites, or steal customer data from WooCommerce stores.
Likely Case
Attackers steal user session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users.
If Mitigated
Script execution is blocked by modern browser XSS protections, limiting impact to basic session hijacking attempts.
🎯 Exploit Status
Exploitation requires tricking users into clicking malicious links. No authentication required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.9 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Product Table for WooCommerce'. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.0.9+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allBlock malicious search_key parameter values containing script tags or JavaScript
Content Security Policy (CSP)
allImplement strict CSP headers to prevent inline script execution
🧯 If You Can't Patch
- Disable the Product Table for WooCommerce plugin immediately
- Implement strict input validation at the web server level for the search_key parameter
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Product Table for WooCommerce version. If version is 5.0.8 or lower, you are vulnerable.Check Version:
wp plugin list --name='product-table-for-woocommerce' --field=versionVerify Fix Applied:
After updating, verify plugin version shows 5.0.9 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'search_key' parameter with script tags or JavaScript code
- Unusual referrer headers pointing to malicious domains
Network Indicators:
- GET requests with encoded script payloads in search_key parameter
- Outbound connections to suspicious domains after page load
SIEM Query:
web.url:*search_key=*<script* OR web.url:*search_key=*javascript:*