What is the CVSS score of CVE-2025-69088?

CVE-2025-69088 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Combo Offers WooCommerce CVE-2025-69088

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS Woocommerce Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-delivered DOM XSS needs an authenticated low-priv account (PR:L) and victim interaction (UI:R); script-in-browser crosses into the victim's context (S:C) with Low C/I/A.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 01, 2026 - 08:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 01, 2026 - 08:32 vuln.today

CVE Published

Dec 30, 2025 - 11:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.

AnalysisAI

DOM-based cross-site scripting in the Vidish Combo Offers WooCommerce plugin (woo-combo-offers) version 4.2 and earlier allows an authenticated attacker holding at least low-level privileges on a WordPress/WooCommerce site to inject script that executes in a victim's browser when the victim loads or interacts with the tainted page element. Exploitation requires both valid credentials (PR:L per the CVSS vector) and victim interaction (UI:R), so it is not reachable by a fully unauthenticated, zero-interaction attacker; the network attack vector and scope change (S:C) keep the score at 6.5, but the practical risk is low. No public exploit code has been identified and the CVE is not in CISA KEV, with an EPSS score of only 0.16% (5th percentile).

Technical ContextAI

The root cause is CWE-79, improper neutralization of input during web page generation, specifically in its DOM-based variant: rather than server-side rendering of unescaped data, the plugin's client-side JavaScript takes attacker-controllable input (for example a URL fragment, query parameter, or stored value surfaced into the DOM) and writes it into a sink such as innerHTML, document.write, or an unvalidated eBay-style attribute without sanitization. Because the flaw lives in the browser-side code path, classic server-side input filtering and output encoding may not prevent execution, and the CVSS scope-change flag (S:C) reflects that code runs in the security context of the WordPress site's origin, enabling access to cookies, session tokens, and authenticated AJAX actions. The affected component is the WordPress plugin distributed as woo-combo-offers from Vidish, which extends WooCommerce with product combo/promotional offers; CPE data for the exact affected build is not enumerated in the supplied sources, and the only vendor-style reference is the Patchstack database entry for the plugin's 4.2 release.

Affected ProductsAI

The Vidish Combo Offers WooCommerce WordPress plugin, package slug woo-combo-offers, is affected in all versions from n/a through 4.2 inclusive, meaning installations running version 4.2 or any earlier release with the plugin active on a WordPress/WooCommerce site are in scope. No specific CPE 2.3 identifier was supplied in the available intelligence, so administrators should verify their installed plugin version directly rather than relying on external CPE matching. The authoritative vendor-facing advisory is the Patchstack entry at https://patchstack.com/database/Wordpress/Plugin/woo-combo-offers/vulnerability/wordpress-combo-offers-woocommerce-plugin-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the cross-site scripting issue in the 4.2 plugin release. Because the plugin is a third-party WooCommerce extension rather than a core component, exposure is limited to sites that have deliberately installed and activated it.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to check the plugin's current release on the vendor/WordPress.org listing and update to the newest version published after 4.2, then re-verify the installed version string; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-combo-offers/vulnerability/wordpress-combo-offers-woocommerce-plugin-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve for update guidance. If no fixed release is yet available, deactivate and remove the plugin entirely if combo offers are not in active use (the cleanest mitigation and removes the attack surface, at the cost of losing the promotional-offer feature), or restrict its exposure by tightening WordPress role assignments so that untrusted users cannot hold Contributor-level or higher accounts, since exploitation requires an authenticated low-privilege account plus victim interaction. Additional compensating controls include deploying a WAF rule set or content security policy that blocks inline and event-handler script execution on the WooCommerce front end (trade-off: a strict script-src policy can break legitimate theme/plugin JavaScript and should be tested in report-only mode first), and auditing existing posts, coupons, and offer records for injected markup before restoring normal operation, since DOM-XSS payloads may already be persisted in stored data.