WPFactory Free Shipping Bar CVE-2025-68528
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Stored XSS requires low-privilege authenticated upload and victim interaction; impact is limited to session-level compromise.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.9.
AnalysisAI
Stored cross-site scripting in the WPFactory Free Shipping Bar plugin for WooCommerce version 2.4.9 and earlier allows authenticated attackers to inject malicious scripts into pages viewed by other users, potentially leading to data theft or session hijacking. The vulnerability requires contributor-level or higher privileges and user interaction to trigger. No active exploitation or public exploit is known at this time.
Technical ContextAI
The vulnerability stems from improper neutralization of input during web page generation (CWE-79) in the WordPress plugin 'amount-left-free-shipping-woocommerce', likely within the free shipping bar configuration settings. When an authenticated user sets bar content, that data is stored and later rendered on front-end WooCommerce pages without adequate output escaping, enabling script injection. The affected component is a WordPress plugin that adds dynamic messaging to the storefront, leveraging the Admin interface and WordPress database.
Affected ProductsAI
The plugin Free Shipping Bar: Amount Left for Free Shipping for WooCommerce, by WPFactory, versions n/a through 2.4.9 are affected. Detailed advisory is available at https://patchstack.com/database/Wordpress/Plugin/amount-left-free-shipping-woocommerce/vulnerability/wordpress-free-shipping-bar-amount-left-for-free-shipping-for-woocommerce-plugin-2-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve.
RemediationAI
Upgrade to a version higher than 2.4.9 if a patched release exists; the Patchstack advisory may contain the exact fix version. If no patch is available, disable the plugin until a fix is released. As a compensating control, restrict access to the plugin's settings to trusted administrator roles only and audit existing bar content for suspicious scripts, but note that these measures do not eliminate the underlying injection flaw.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today