What is the CVSS score of CVE-2025-26553?

CVE-2025-26553 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Pre Order Addon for WooCommerce are affected by CVE-2025-26553?

Pre Order Addon for WooCommerce versions 2.2 and earlier contains a reflected cross-site scripting (XSS) vulnerability that could allow attackers to steal administrator credentials or hijack sessions…

How to fix or mitigate CVE-2025-26553?

Within 24 hours: Inventory all WooCommerce instances using Pre Order Addon and document current versions. Within 7 days: Disable or remove Pre Order Addon if not actively used in production; if required, implement Web Application Firewall (WAF) rules to sanitize URL parameters and block suspicious input patterns. Within 30 days: Monitor vendor for patch release and establish update process; conduct security awareness training on phishing/malicious link risks for administrative staff.

Pre Order Addon for WooCommerce CVE-2025-26553

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-15 audit@patchstack.com

WordPress XSS Java

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:31 vuln.today

CVE Published

Mar 15, 2025 - 22:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce - Advance Order/Backorder Plugin allows Reflected XSS. This issue affects Pre Order Addon for WooCommerce - Advance Order/Backorder Plugin: from n/a through 2.2.

AnalysisAI

Reflected cross-site scripting (XSS) in Pre Order Addon for WooCommerce versions through 2.2 allows remote attackers to execute malicious JavaScript in victim browsers via specially crafted URLs. The vulnerability requires victim interaction (UI:R) and enables cross-site scope (S:C) attacks, potentially leading to session hijacking, credential theft, or malicious actions performed in the context of authenticated WooCommerce administrators. EPSS score of 0.09% (26th percentile) indicates low probability of mass exploitation, with no public exploit code or CISA KEV listing identified. This is a typical stored input validation flaw in WordPress plugin development affecting e-commerce environments.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in a WordPress/WooCommerce plugin that manages pre-order and backorder functionality for online stores. The flaw stems from improper neutralization of user-supplied input during dynamic web page generation, allowing attacker-controlled data to be reflected back to users without adequate sanitization or output encoding. WordPress plugins commonly suffer from XSS when developers fail to use WordPress's built-in escaping functions (esc_html, esc_url, wp_kses) on user input rendered in admin panels or public-facing pages. The vulnerability affects versions through 2.2, indicating longstanding insecure coding practices in input validation and output encoding routines within the plugin's codebase.

Affected ProductsAI

Spring Devs Pre Order Addon for WooCommerce (also marketed as Advance Order/Backorder Plugin) versions from earliest release through version 2.2 are confirmed vulnerable. This WordPress plugin integrates with WooCommerce to provide pre-order and backorder management capabilities for online stores. The vulnerability was reported by Patchstack's security audit team, indicating discovery through third-party security research rather than vendor disclosure. Administrators should verify their installed version via WordPress admin dashboard under Plugins section (plugin slug: wc-pre-order).

RemediationAI

Immediately update Pre Order Addon for WooCommerce to version 2.3 or later if available, referencing the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wc-pre-order/vulnerability/wordpress-pre-order-addon-for-woocommerce-plugin-1-0-7-reflected-cross-site-scripting for patched version confirmation. If no patched version exists or immediate patching is infeasible, implement these compensating controls: (1) Disable the plugin entirely if pre-order functionality is not business-critical-this eliminates attack surface but removes all pre-order capabilities; (2) Restrict plugin access to trusted administrator IPs via WordPress firewall rules or .htaccess (limits who can trigger the vulnerability but does not prevent social engineering of authorized admins); (3) Deploy web application firewall (WAF) rules to detect and block common XSS payloads in HTTP parameters, though this provides incomplete protection against obfuscated attacks and may cause false positives blocking legitimate admin actions. Educate administrators never to click untrusted links while logged into WordPress admin panel.