What is the CVSS score of CVE-2025-59004?

CVE-2025-59004 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WC Return Products are affected by CVE-2025-59004?

The WC Return products WordPress plugin (versions up to 1.5) contains a reflected cross-site scripting flaw that can allow an attacker to execute script in a victim's browser session if the victim…

How to fix or mitigate CVE-2025-59004?

Within 24 hours, inventory all WordPress installations to identify any running the WC Return products plugin (all versions up to and including 1.5) and immediately deactivate and remove the plugin from any site where it is not business-critical; if deactivation is not possible, apply a web application firewall (WAF) rule to block reflected script payloads targeting this plugin's endpoints and enable a strict Content Security Policy. Within 7 days, confirm removal or mitigation across all affected sites, review web server and WAF logs for attempted exploitation, and communicate to site owners and users about the risk of clicking untrusted links; monitor the plugin vendor's advisory page for a patch. Within 30 days, if the plugin remains necessary, evaluate and migrate to a maintained alternative return-management plugin, or re-deploy only after a vendor patch is released and tested; otherwise, permanently decommission the plugin and document the change.

WC Return Products CVE-2025-59004

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Woocommerce Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS is network-reachable with no attacker privileges (PR:N) but needs victim click (UI:R); script runs cross-context (S:C) with Low C/I and no realistic availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 12:31 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5.

AnalysisAI

Reflected cross-site scripting in the WC Return products WordPress plugin (all versions up to and including 1.5) allows remote attackers to execute arbitrary script in a victim's browser session by luring that victim to a crafted URL whose input is reflected unsanitized into a page the plugin generates. Per the authoritative assessment (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker-side authentication is required (PR:N) but exploitation hinges on victim interaction (UI:R), so the attacker cannot trigger execution autonomously and impact is bounded by the clicking victim's session privileges. Only sites with the plugin installed and active are reachable via this code path; EPSS is low (0.25%, 15th percentile), the flaw is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

This is a classic CWE-79 improper neutralization of input during web page generation - specifically a reflected XSS pattern - in a WordPress plugin that extends WooCommerce with return/RMA functionality. The plugin accepts attacker-controllable input (typically a query-string or request parameter) and writes it back into the HTML response without output encoding or sanitization, so the browser parses injected markup and script as part of the page. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates the attack is delivered over the network, needs no privileges to craft but requires the victim to click a specially crafted link, and crosses a security scope boundary (S:C) because the injected script runs in the context of the vulnerable WordPress site and can therefore reach the victim's authenticated session, cookies, or CSRF-capable endpoints on that origin. CPE data is not supplied in the available intelligence, but the affected artifact is unambiguously the WordPress plugin slug wc-return-product (vendor pco_58) at version 1.5 and earlier; the vulnerable code path is only reachable on WordPress installations where the plugin is installed and active, and its practical value to an attacker is highest on sites where an administrator or shop manager can be socially engineered into clicking the link.

Affected ProductsAI

The affected product is the WC Return products plugin for WordPress, published by pco_58 under the slug wc-return-product, across all versions from n/a through 1.5 inclusive (i.e., 1.5 is the highest vulnerable release listed). Because the plugin augments WooCommerce storefronts, the realistic exposure set is WordPress sites running WooCommerce that have this plugin installed and activated; sites where the plugin is installed but inactive are not reachable via this code path. No CPE strings were provided in the supplied intelligence feed, so version matching should be performed against the plugin's own version header/slug rather than a CPE dictionary. The vendor-facing reference is the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wc-return-product/vulnerability/wordpress-wc-return-products-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the reflected XSS in the 1.5 release.

RemediationAI

Patch status is not confirmed by the available data: no fixed version is named in the supplied references, and the only advisory link (the Patchstack entry for wc-return-product 1.5) documents the issue rather than an upgrade target, so administrators should check the plugin's WordPress.org page and the Patchstack advisory directly for a newly released version before assuming a fix exists. Until a vendor-released version above 1.5 is verified, the most effective action is to deactivate and delete the WC Return products plugin if the store does not depend on it - this removes the vulnerable code path entirely and carries only the trade-off of losing the return/RMA feature. If the functionality is business-critical, the plugin must stay enabled, so treat the reflected XSS as an accepted, managed risk and layer compensating controls: deploy a WAF or reverse-proxy rule that inspects and blocks script-bearing markup in query parameters and request bodies targeting plugin endpoints (side effect: possible false positives on legitimate input and ongoing rule maintenance); enforce a strict Content-Security-Policy on the WordPress origin that disallows inline and third-party scripts (side effect: may break themes or other plugins that rely on inline JavaScript); set HttpOnly and SameSite=Lax/Strict on session cookies to reduce cookie theft from injected script (side effect: may affect cross-site workflows); and require any user who might be targeted - especially administrators and shop managers - to keep sessions short and resist clicking unsolicited links. Monitor the Patchstack advisory and the plugin changelog for a fixed release and upgrade as soon as one is published.