Stored Cross-Site Scripting Vulnerability in Recently Purchased Products For Woo Plugin by WordPress

CVE-2025-1008

What is CVE-2025-1008?

The Recently Purchased Products For Woo plugin for WordPress has a Stored Cross-Site Scripting vulnerability caused by inadequate input sanitization and output escaping. This vulnerability allows authenticated users with Contributor-level access or higher to embed malicious web scripts through the ‘view’ parameter. When a user accesses an affected page, their browser will execute the injected scripts, posing a security risk by potentially leading to data theft or unauthorized actions.

References