Cross-site Scripting Vulnerability in Woocommerce Line Notify by WordPress
CVE-2025-30972

7.1HIGH

Key Information:

Vendor

WordPress
Status
WooCommerce Line Notify
Vendor
CVE Published:
27 June 2025

What is CVE-2025-30972?

A vulnerability in the Woocommerce Line Notify plugin for WordPress allows attackers to inject malicious scripts into web pages displayed to users. This issue, caused by improper handling of user input, can lead to Stored XSS attacks, where an attacker can store harmful scripts that execute when other users view affected content. The vulnerability impacts versions of the plugin from n/a through 1.1.7, posing a significant security risk to websites utilizing this plugin.

Affected Version(s)

Woocommerce Line Notify <= 1.1.7

References

https://patchstack.com/database/wordpress/plugin/woo-line...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.
CVE-2025-30972 : Cross-site Scripting Vulnerability in Woocommerce Line Notify by WordPress