What is the CVSS score of CVE-2025-60173?

CVE-2025-60173 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of GST for WooCommerce are affected by CVE-2025-60173?

CVE-2025-60173 is a cross-site request forgery vulnerability in GST for WooCommerce plugin (≤v2.0) that permits attackers to inject persistent malicious scripts into WordPress sites through…

How to fix or mitigate CVE-2025-60173?

Within 24 hours: Identify all WordPress installations using GST for WooCommerce plugin versions 2.0 or earlier via plugin management dashboard and document current version deployed. Within 7 days: Disable or remove the GST for WooCommerce plugin if no vendor patch is available, or evaluate alternative GST solutions compatible with your WooCommerce version; if plugin remains in use, implement strict administrator access controls (IP whitelisting, MFA enforcement) and restrict admin user accounts to essential personnel only. Within 30 days: Once patch becomes available, upgrade to the patched version immediately and conduct content audit of WordPress site for unauthorized script injections or admin activity anomalies.

GST for WooCommerce CVE-2025-60173

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-09-26 audit@patchstack.com

WordPress CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce allows Stored XSS. This issue affects GST for WooCommerce: from n/a through 2.0.

AnalysisAI

Cross-Site Request Forgery in GST for WooCommerce WordPress plugin versions ≤2.0 enables attackers to execute stored XSS attacks by tricking authenticated administrators into performing malicious actions. The vulnerability allows remote attackers to bypass authorization controls and inject persistent malicious scripts without authentication, though successful exploitation requires user interaction. EPSS score of 0.01% (3rd percentile) indicates very low observed exploitation probability in the wild, with no CISA KEV listing or confirmed active exploitation at time of analysis.

Technical ContextAI

This vulnerability combines two weaknesses in the GST for WooCommerce WordPress plugin: CWE-352 (Cross-Site Request Forgery) as the primary attack vector, enabling stored XSS as the resulting impact. CSRF vulnerabilities occur when a web application fails to validate that requests originate from authenticated users with legitimate intent, typically through missing or inadequate anti-CSRF tokens. The WordPress plugin ecosystem relies on nonce validation for CSRF protection, and this plugin appears to lack proper nonce verification on admin actions that modify stored content. The CVSS Changed Scope (S:C) metric indicates the XSS payload escapes the vulnerable component's security context, affecting other users and sessions beyond the initial CSRF victim. This chain demonstrates how authorization bypass (CSRF) enables injection attacks (XSS) when input validation and output encoding are also absent.

Affected ProductsAI

GST for WooCommerce WordPress plugin versions 2.0 and earlier are confirmed vulnerable based on Patchstack database reporting. The plugin provides Goods and Services Tax calculation functionality for WooCommerce e-commerce installations. No CPE identifiers are available in the provided data. Affected deployments are WordPress sites running WooCommerce with this tax calculation plugin installed, particularly those where administrators might interact with external content or links while authenticated.

RemediationAI

Update GST for WooCommerce to a patched version addressing CVE-2025-60173 per the vendor advisory at https://patchstack.com/database/wordpress/plugin/gst-for-woocommerce/vulnerability/wordpress-gst-for-woocommerce-plugin-2-0-cross-site-request-forgery-csrf-vulnerability (specific fixed version number not provided in available data - verify current version implements CSRF token validation). If immediate patching is not feasible, implement compensating controls: restrict WordPress admin access to trusted networks only via firewall rules or .htaccess IP allowlisting (trade-off: reduces admin mobility), enforce security awareness training for administrators to avoid clicking external links while logged in (human-dependent control with variable effectiveness), and deploy Web Application Firewall rules to detect CSRF attempts lacking valid nonces (may generate false positives on legitimate workflows). Monitor WordPress admin audit logs for unexpected content modifications or plugin setting changes. These mitigations reduce but do not eliminate risk; prioritize applying the vendor patch.