Stored XSS Vulnerability in Email Customizer for WooCommerce Plugin by WordPress

CVE-2025-13974

What is CVE-2025-13974?

The Email Customizer for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and insufficient output escaping in the email template content. Authenticated attackers with administrator access can exploit this vulnerability to insert malicious web scripts into email templates. These scripts execute when customers open transactional emails, posing a significant threat, particularly in multi-site installations or where the unfiltered_html capability has been disabled.

References