What is the CVSS score of CVE-2025-67542?

CVE-2025-67542 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Multi-Step Checkout CVE-2025-67542

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 audit@patchstack.com

WordPress XSS Woocommerce Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable DOM XSS requiring a low-privileged account (PR:L) and victim interaction (UI:R); scope changes to the browser context (S:C); limited C/I impact and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 22:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 07, 2026 - 22:14 vuln.today

CVE Published

Dec 09, 2025 - 16:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a through <= 2.33.

AnalysisAI

DOM-based cross-site scripting in Multi-Step Checkout for WooCommerce versions up to and including 2.33 allows low-privileged authenticated attackers to inject malicious scripts that execute in a victim's browser when they interact with the checkout page. The vulnerability requires user interaction and does not enable server-side code execution, and no public exploit code is identified at time of analysis; EPSS is low at 0.20%. This is a moderate risk that should be patched on a normal cycle rather than as an emergency.

Technical ContextAI

The vulnerability is a DOM-based cross-site scripting (CWE-79) in the WordPress plugin Multi-Step Checkout for WooCommerce, which customizes the checkout process in WooCommerce stores. DOM-based XSS occurs when client-side JavaScript processes user-controlled data and writes it to the DOM without proper sanitization, allowing script execution in the victim's browser. The affected versions are all releases up to and including 2.33; the plugin must be installed and active on a WordPress site with WooCommerce. The assessed CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates that the attack is network-based, requires low privileges, and requires user interaction, with a changed scope and low confidentiality and integrity impact but no availability impact.

Affected ProductsAI

Multi-Step Checkout for WooCommerce (wp-multi-step-checkout) versions from n/a through 2.33 are affected. The plugin is a WordPress plugin that integrates with WooCommerce. No specific CPE is provided in the available data. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-multi-step-checkout/vulnerability/wordpress-multi-step-checkout-for-woocommerce-plugin-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve) provides further details.

RemediationAI

No vendor-released patch has been identified at the time of analysis. As a primary fix, upgrade the Multi-Step Checkout for WooCommerce plugin to a version newer than 2.33 as soon as one is available; monitor the vendor's site and the Patchstack advisory for updates. If immediate upgrade is not possible, consider the following compensating controls with their trade-offs: enforce a strict Content Security Policy (CSP) to block inline script execution, though this may break legitimate plugin functionality; restrict the ability for low-privileged users to access the checkout page, which could hinder normal store operations; and disable the plugin temporarily if not essential, noting that this will remove multi-step checkout capabilities. Additionally, ensure that all user inputs are properly sanitized and encoded, and review the plugin's JavaScript for unsafe DOM manipulation.