Email Template Customizer CVE-2025-64200
MEDIUMSeverity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Stored XSS requiring an authenticated high-privilege role to inject (PR:H) and victim rendering (UI:R); script runs cross-context (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17.
AnalysisAI
Stored cross-site scripting in VillaTheme Email Template Customizer for WooCommerce (versions up to and including 1.2.17) allows an authenticated high-privilege user to inject malicious JavaScript into email template fields, which then executes in the browser of another user who views the affected template. The flaw requires both elevated privileges (PR:H) and victim interaction (UI:R), and no public exploit or active exploitation has been identified at time of analysis (EPSS 0.18%).
Technical ContextAI
The vulnerability is a classic stored XSS (CWE-79) in a WordPress plugin that customizes WooCommerce email templates. The plugin fails to properly sanitize or escape user-supplied input-such as template content or settings-before rendering it in the admin interface or email preview, allowing persistent JavaScript injection. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) indicates that an attacker must already possess high privileges (e.g., administrator or shop manager with access to the plugin's settings) to store the payload, and a separate user must then interact with the affected page (e.g., preview or edit the template) for execution. The scope change (S:C) reflects that the injected script runs in the context of the victim's browser session, potentially affecting resources beyond the vulnerable component.
Affected ProductsAI
All versions of VillaTheme Email Template Customizer for WooCommerce up to and including 1.2.17 are affected. No specific CPE string is provided in the source data. The plugin is used on WordPress sites running WooCommerce; the vendor advisory is available at the Patchstack link: https://patchstack.com/database/Wordpress/Plugin/email-template-customizer-for-woo/vulnerability/wordpress-email-template-customizer-for-woocommerce-plugin-1-2-17-cross-site-scripting-xss-vulnerability?_s_id=cve
RemediationAI
Vendor-released patch status is not specified in the provided data; consult the Patchstack advisory for the exact fixed version and update the plugin accordingly. If a patch is not yet available, restrict access to the Email Template Customizer settings to only the most trusted high-privilege users (the vulnerability requires PR:H to inject the payload), and consider temporarily disabling the plugin to remove the stored XSS vector-though this disables WooCommerce email template customization. As an additional mitigation, deploy a Content Security Policy that disallows inline scripts to reduce the impact of any stored XSS, but be aware that CSP may break legitimate plugin functionality. Monitor the advisory for updates.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today