Stored Cross-Site Scripting Vulnerability in WPFactory's WooCommerce Plugin
CVE-2025-31598

6.5MEDIUM

Key Information:

Vendor

WPfactory

Status
Quantity Dynamic Pricing & Bulk Discounts For WooCommerce
Vendor
CVE Published:
31 March 2025

What is CVE-2025-31598?

An improper neutralization of input during web page generation in the Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin could allow attackers to exploit stored cross-site scripting vulnerabilities. This flaw enables malicious users to inject script code into pages viewed by other users, potentially leading to unauthorized actions and data exposure. The affected versions range from n/a through 4.0.0. It is crucial for users to update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 4.0.0

References

https://patchstack.com/database/wordpress/plugin/wholesal...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis (Patchstack Alliance)
.
CVE-2025-31598 : Stored Cross-Site Scripting Vulnerability in WPFactory's WooCommerce Plugin