YITH Quick View CVE-2025-8617
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Requires an authenticated contributor account (PR:L) over the network (AV:N); stored payload auto-executes on page load (UI:N) in the victim's browser, a different scope (S:C), with limited confidentiality/integrity impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the YITH WooCommerce Quick View WordPress plugin (all versions up to and including 2.7.0) allows an authenticated attacker holding contributor-level privileges or above to inject arbitrary JavaScript into pages through unsanitized attributes passed to the plugin's yith_quick_view shortcode. The payload is persisted in post/page content and executes in the browser of any visitor who later opens the affected page - most dangerously a higher-privileged user such as an administrator, which could lead to session or privilege abuse on the site. Severity is moderate (CVSS 6.4, scope changed) rather than critical: exploitation requires an existing contributor account, EPSS is only 0.29% (20th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis.
Technical ContextAI
This is a classic CWE-79 improper neutralization issue in the WordPress shortcode subsystem. The plugin registers a yith_quick_view shortcode whose user-supplied attributes are rendered by includes/class.yith-wcqv-frontend.php (referenced around line 216) without adequate input sanitization and without context-appropriate output escaping before being written into the HTML response. Because WordPress stores shortcode-bearing post content, the injected markup is persisted and re-emitted on every subsequent page view, making it a stored (persistent) rather than reflected XSS. The adverse CVSS scope change (S:C) reflects that the malicious script runs with the origin and privileges of the hosting WordPress site, not merely the plugin, so it can act on the whole application context - reading nonces, performing actions as the viewing user, or exfiltrating data. Contributors can create and edit their own posts but normally lack unfiltered_html and the ability to publish, so the practical attack chain is contributor-authored content viewed by an administrator or other privileged user. EPSS 0.29% (20th percentile) and the absence of any KEV listing indicate low observed exploitation interest, consistent with the authentication prerequisite. Tags associated with this record are WordPress and XSS; no CPE strings were supplied in the available intelligence, so affected-version scoping is taken from the vendor plugin listing and the advisory text.
Affected ProductsAI
The YITH WooCommerce Quick View plugin for WordPress is affected in all versions up to and including 2.7.0, as published on the WordPress.org plugin directory (https://wordpress.org/plugins/yith-woocommerce-quick-view). The vulnerable code path is the shortcode handler in includes/class.yith-wcqv-frontend.php, reachable from any post or page where the yith_quick_view shortcode can be inserted - which in practice means any site running the plugin and granting contributor-level accounts to the content authors. The vendor's Trac browser view of that file (https://plugins.trac.wordpress.org/browser/yith-woocommerce-quick-view/trunk/includes/class.yith-wcqv-frontend.php#L216) documents the affected source location, and the corresponding changeset record (https://plugins.trac.wordpress.org/changeset?old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view) documents the upstream code change. No explicit CPE strings were included in the supplied intelligence, so no additional platform or version identifiers can be confirmed beyond the plugin's own version line. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=cve) is the authoritative third-party reference for the affected range.
RemediationAI
The primary fix is to update the YITH WooCommerce Quick View plugin to a release newer than 2.7.0, which is the highest version named as vulnerable; the upstream code fix is recorded in the plugin's Trac changeset 3353775 (https://plugins.trac.wordpress.org/changeset?old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view), so the corrected code is available upstream, although an exact patched release number is not independently confirmed in the provided data - always install the newest version offered by the vendor or by the WordPress.org plugin page and review the plugin changelog before relying on a specific number. If immediate patching is not possible, the highest-value compensating control is to stop untrusted users from obtaining contributor-level accounts (audit and downgrade or remove contributor roles, disable open registration, and require review before role assignment); the trade-off is reduced editorial flexibility, but it removes the authentication prerequisite entirely. Similarly, disabling the plugin or deactivating it until the update can be applied removes the attack surface, at the cost of losing the quick-view feature on the storefront. Site operators can also search existing posts and pages for yith_quick_view shortcode usage and manually strip or clean any user-submitted attributes, and can layer a web application firewall or WordPress security plugin with XSS output filtering plus a restrictive Content-Security-Policy that blocks inline script execution - though CSP will break any legitimate inline scripts on the site and should be deployed in report-only mode first. Because exploitation requires a privileged user to view planted content, prompt credential hygiene (rotating administrator sessions and reissuing passwords after any suspected injection) limits the impact of successful stored payloads.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today