What is the CVSS score of CVE-2025-49947?

CVE-2025-49947 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of WooCommerce Registration Fields are affected by CVE-2025-49947?

The extendons WooCommerce Registration Fields plugin for WordPress (all versions through 3.2.3) contains a reflected cross-site scripting vulnerability that can compromise a user's browser session…

How to fix or mitigate CVE-2025-49947?

No vendor-released patch identified at time of analysis; therefore, within 24 hours, inventory all WordPress sites using the extendons WooCommerce Registration Fields plugin versions through 3.2.3 and disable the plugin if it is not business-critical. If it must remain active, deploy a web application firewall rule to block reflected XSS attempts targeting the plugin's parameters and advise users to avoid clicking unsolicited links. Within 7 days, evaluate and test alternative registration plugins that provide equivalent functionality, and plan a migration while monitoring vendor communications. Within 30 days, if no patch is released, complete migration to a supported alternative or implement a custom code fix, and conduct a security review of all WordPress plugins to identify similar unpatched vulnerabilities.

WooCommerce Registration Fields CVE-2025-49947

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Woocommerce Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS needs no privileges (PR:N) but requires victim link-clicking (UI:R); S:C and C:L/I:L reflect cross-context script execution, and A:N because XSS does not impair availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 13:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 13:12 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

AnalysisAI

Reflected cross-site scripting in the extendons WooCommerce Registration Fields plugin - Custom Signup Fields (extendons-registration-fields) for WordPress, affecting all versions through 3.2.3, allows remote attackers to inject and execute arbitrary script in the browser of a user who opens a crafted link. Exploitation is unauthenticated from the attacker's side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but depends on social engineering, since each victim must be lured into opening the malicious URL; impact is confined to the victim's browser session within the WordPress site's origin rather than to the server or host. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.28% (19th percentile), making this a moderate-priority patch item rather than an emergency.

Technical ContextAI

The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic cross-site scripting class, arising in the WordPress plugin extendons-registration-fields ('WooCommerce Registration Fields Plugin - Custom Signup Fields'), which renders custom signup/registration form fields on WooCommerce storefronts. A plugin endpoint reflects attacker-supplied input back into the generated HTML page without adequate output encoding or escaping, so markup and script delivered in the request are rendered by the browser as part of the page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates the attack is network-deliverable, requires no privileges to craft (PR:N), is trivial to execute (AC:L), but requires a victim to interact with the page (UI:R) and results in a scope change (S:C) because the injected script executes in the context of the victim's browser session under the WordPress site's origin, where it can read page content, act as the user, and reach same-origin resources. The independent assessment refines availability impact to none (A:N), consistent with a reflected, browser-side flaw that does not degrade the server. Because the reflection is transient rather than stored, there is no persistent payload and each target must be individually induced to visit the crafted URL.

Affected ProductsAI

The affected product is the WordPress plugin 'WooCommerce Registration Fields Plugin - Custom Signup Fields' by extendons (slug: extendons-registration-fields), all versions from n/a through and including 3.2.3. Any WordPress site with this plugin installed and active is exposed, provided the reflecting endpoint is reachable; no specific plugin configuration is documented, but WooCommerce-based registration/signup flows are the expected exposure surface. No CPE string was supplied in the intelligence feed, so affected instances should be enumerated by plugin slug and version rather than by CPE matching. The authoritative vendor-facing entry is the Patchstack vulnerability database record at https://patchstack.com/database/Wordpress/Plugin/extendons-registration-fields/vulnerability/wordpress-woocommerce-registration-fields-plugin-custom-signup-fields-plugin-3-2-3-cross-site-scripting-xss-vulnerability, which credits audit@patchstack.com and is the sole reference in the current feed.

RemediationAI

No vendor-released patch version is identified in the available intelligence; the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/extendons-registration-fields/vulnerability/wordpress-woocommerce-registration-fields-plugin-custom-signup-fields-plugin-3-2-3-cross-site-scripting-xss-vulnerability) records the issue as affecting versions through 3.2.3, so administrators should monitor that entry and update the plugin to the first version released after 3.2.3 as soon as it is published. If no fixed release is available when triage occurs, the strongest compensating control is to deactivate and remove the plugin if custom signup fields are not required, accepting that any custom registration field data collection stops working; alternatively, restrict use to sites where registration is disabled or the signup endpoints are not publicly reachable. A web application firewall or reverse-proxy rule can be deployed to filter script-bearing payloads targeting the plugin's reflecting endpoint, with the trade-off of potential false positives on legitimate field input and no protection against bypasses. Enforcing a Content-Security-Policy with a restrictive script-src (for example, nonce- or hash-based) significantly reduces reflected XSS execution but commonly breaks inline scripts in WordPress themes and other plugins and requires testing. Note that HttpOnly and SameSite cookie flags only limit session-cookie theft or cross-site transmission and do not stop script execution in the site's own origin, so they are supplemental rather than sufficient; user awareness training against opening unsolicited links addresses the mandatory UI:R precondition but is not a technical fix.