CVE-2025-49042: WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability
Published Oct 29, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.
Affected Software
1 affected component
Automattic WooCommerce<=10.0.2
Remediation
Information
Update the WordPress WooCommerce plugin to the latest available version (at least 10.0.3).
Event History
Oct 29, 2025
CVE Published
via MITRE·04:50 AM
Data Sourced
via MITRE·04:50 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-49042?
CVE-2025-49042 is classified as a high-severity Stored Cross-site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-49042?
To fix CVE-2025-49042, you should update WooCommerce to version 10.0.3 or later.
3
Which versions of WooCommerce are affected by CVE-2025-49042?
CVE-2025-49042 affects WooCommerce versions up to and including 10.0.2.
4
What types of attacks can CVE-2025-49042 facilitate?
This vulnerability can facilitate Stored Cross-site Scripting (XSS) attacks, allowing attackers to inject malicious scripts.
5
Who is impacted by CVE-2025-49042?
Any user or administrator using affected versions of WooCommerce could be impacted by CVE-2025-49042.