CVE-2025-13369 – The Premmerce WooCommerce Customers Manager plu... (How to Fix)

Q: What is the severity of CVE-2025-13369?

CVE-2025-13369 has a CVSS score of 6.1 (MEDIUM). The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via specific filter parameters. Unauthenticated attackers can inject malicious scripts that execute when administrators click specially crafted links, potentially compromising admin sessions and site security. All WordPress sites using this plugin up to version 1.1.14 are affected.

📋 TL;DR

The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via specific filter parameters. Unauthenticated attackers can inject malicious scripts that execute when administrators click specially crafted links, potentially compromising admin sessions and site security. All WordPress sites using this plugin up to version 1.1.14 are affected.

💻 Affected Systems

Products:

Premmerce WooCommerce Customers Manager for WordPress

Versions: All versions up to and including 1.1.14

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with WooCommerce installed and the vulnerable plugin activated. Attack requires tricking an administrator into clicking a malicious link.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator account takeover leading to full WordPress site compromise, data theft, malware installation, or complete site defacement.

🟠

Likely Case

Session hijacking of administrator accounts, leading to unauthorized access to sensitive customer data and plugin/theme modifications.

🟢

If Mitigated

Script execution blocked by browser security features or Content Security Policy, resulting in no impact.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires social engineering to trick administrators into clicking malicious links. No authentication required to trigger the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.1.15 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3200000%40woo-customers-manager%2Ftrunk&old=3199999%40woo-customers-manager%2Ftrunk

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WooCommerce Customers Manager' and click 'Update Now'. 4. Verify update to version 1.1.15 or higher.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the WooCommerce Customers Manager plugin until patched.

wp plugin deactivate woo-customers-manager

Implement Content Security Policy

all

Add CSP headers to block inline script execution and restrict script sources.

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or configure via WordPress security plugin

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block XSS payloads in URL parameters
Educate administrators about phishing risks and implement link validation procedures

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 1.1.14 or lower, you are vulnerable.

Check Version:

wp plugin get woo-customers-manager --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.1.15 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual GET requests containing script tags in money_spent_from, money_spent_to, registered_from, or registered_to parameters
Multiple failed login attempts following suspicious URL accesses

Network Indicators:

HTTP requests with JavaScript payloads in URL parameters to admin-ajax.php or plugin endpoints

SIEM Query:

source="web_logs" AND (uri="*money_spent_from=*<script>*" OR uri="*money_spent_to=*<script>*" OR uri="*registered_from=*<script>*" OR uri="*registered_to=*<script>*")

📊 Metadata

CVE ID: CVE-2025-13369

CVSS v3 Score: 6.1 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.15% exploit probability (35.1th percentile)

Published: January 7, 2026

Last Updated: January 8, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13369, you might also want to check these: