PT-2025-39612 · WordPress · Conditional Cart Messages For Woocommerce

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-60171

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Conditional Cart Messages for WooCommerce versions through 1.2.10

Description A Cross-Site Request Forgery (CSRF) issue exists that also allows Stored Cross-Site Scripting (XSS). The issue is present in yourplugins Conditional Cart Messages for WooCommerce. The vulnerability allows for the execution of malicious scripts.

Recommendations Update Conditional Cart Messages for WooCommerce to a version later than 1.2.10.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-60171

Affected Products

Conditional Cart Messages For Woocommerce

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-60171 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/yourplugins-wc-conditional-cart-notices/vulnerability/wordpress-conditional-cart-messages-for-woocommerce-yourplugins-com-plugin-1-2-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/33439 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/yourplugins-wc-conditional-cart-notices/vulnerability/wordpress-conditional-cart-messages-for-woocommerce-yourplugins-com-plugin-1-2-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1971499174505103485 · Twitter Post