Stored XSS Vulnerability in Email Customizer for WooCommerce Plugin by WordPress

CVE-2025-13974

What is CVE-2025-13974?

The Email Customizer for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and insufficient output escaping in the email template content. Authenticated attackers with administrator access can exploit this vulnerability to insert malicious web scripts into email templates. These scripts execute when customers open transactional emails, posing a significant threat, particularly in multi-site installations or where the unfiltered_html capability has been disabled.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References