What is the CVSS score of CVE-2025-60171?

CVE-2025-60171 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Conditional Cart Messages for WooCommerce are affected by CVE-2025-60171?

Conditional Cart Messages for WooCommerce (YourPlugins) versions up to 1.2.10 contain a stored cross-site scripting vulnerability exploitable through CSRF attacks that could allow attackers to inject…

How to fix or mitigate CVE-2025-60171?

Within 24 hours: disable the Conditional Cart Messages plugin or restrict administrator access to trusted networks only. Within 7 days: contact YourPlugins for patch timeline; if unavailable, evaluate alternative cart messaging plugins with security track records. Within 30 days: implement Web Application Firewall (WAF) rules to block script injection patterns in cart-related requests and enforce Content Security Policy (CSP) headers to mitigate stored XSS execution.

Conditional Cart Messages for WooCommerce CVE-2025-60171

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-09-26 audit@patchstack.com

WordPress CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com allows Stored XSS. This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through 1.2.10.

AnalysisAI

Stored XSS in Conditional Cart Messages for WooCommerce (YourPlugins) through version 1.2.10 is exploitable via CSRF, allowing remote attackers to inject malicious scripts that execute in administrator contexts when victims are tricked into visiting crafted pages. The vulnerability chain requires user interaction but no authentication, enabling scope change (C) impacts across confidentiality, integrity, and availability. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity, and no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

This is a WordPress plugin vulnerability combining two weaknesses: CWE-352 (Cross-Site Request Forgery) as the attack vector and Stored XSS as the payload. The CSRF flaw allows attackers to bypass access controls by forging requests from authenticated administrators. When the CSRF is successful, it enables injection of persistent malicious JavaScript into the plugin's cart message configuration, which then executes in the context of other users viewing affected pages. The CVSS scope change (S:C) indicates the vulnerability breaks trust boundaries, allowing attacks originating in the plugin context to impact the broader WordPress installation. WordPress plugins often fail to implement proper nonce validation on administrative forms, and when combined with insufficient output encoding, create this dual-vulnerability pattern. The affected component is yourplugins-wc-conditional-cart-notices (internal slug), part of the WooCommerce ecosystem extending e-commerce cart functionality.

Affected ProductsAI

WordPress plugin 'Conditional Cart Messages for WooCommerce' by YourPlugins.com (plugin slug: yourplugins-wc-conditional-cart-notices) versions from unknown initial release through version 1.2.10 are confirmed vulnerable per Patchstack database. The vulnerability affects all installations running version 1.2.10 or earlier. CPE and specific vendor-maintained version matrices are not available in public CVE records. Full advisory details are available at Patchstack's vulnerability database at https://patchstack.com/database/wordpress/plugin/yourplugins-wc-conditional-cart-notices/vulnerability/wordpress-conditional-cart-messages-for-woocommerce-yourplugins-com-plugin-1-2-10-cross-site-request-forgery-csrf-vulnerability.

RemediationAI

Update Conditional Cart Messages for WooCommerce plugin to version 1.2.11 or later if available - verify current version via WordPress.org plugin repository or vendor site at YourPlugins.com for confirmed patch release. If no patched version exists yet, implement these compensating controls: (1) Restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, reducing CSRF attack surface but limiting remote administration capabilities; (2) Enforce Content Security Policy headers to mitigate stored XSS execution, though this may break legitimate inline scripts in WordPress admin; (3) Disable the plugin entirely if conditional cart messaging is not business-critical, eliminating vulnerability but removing promotional messaging functionality; (4) Train administrators to logout of WordPress before browsing external sites and never click links in unsolicited emails while authenticated. Monitor Patchstack advisories at the reference URL for official patch announcements and changelog confirmation of CSRF/XSS fixes.