PT-2025-51083 · Unknown+1 · Woocommerce+1

Djaidja Moundjid · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-8617

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Quick View plugin versions prior to 2.7.1

Description The YITH WooCommerce Quick View plugin for WordPress has a flaw that allows an attacker to inject malicious code into web pages. This is due to inadequate handling of user-provided information and insufficient protection of output. An authenticated attacker with contributor-level access or higher can exploit this to insert arbitrary web scripts into pages. These scripts will then run when a user visits the compromised page. The vulnerability exists because of insufficient input sanitization and output escaping on user supplied attributes within the plugin’s yith quick view shortcode.

Recommendations Update the YITH WooCommerce Quick View plugin to version 2.7.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8617

Affected Products

Woocommerce

Yith Woocommerce Quick View

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8617 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1999865353774792873 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=cve · Note
• https://t.me/CVEtracker/39688 · Telegram Post
• https://wordpress.org/plugins/yith-woocommerce-quick-view · Note
• https://twitter.com/VulmonFeeds/status/1999913486441210038 · Twitter Post
• https://plugins.trac.wordpress.org/browser/yith-woocommerce-quick-view/trunk/includes/class.yith-wcqv-frontend.php#L216 · Note