CVE-2025-27324

WordPress 17TRACK for WooCommerce Plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Published Apr 17, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce 17track allows Reflected XSS.This issue affects 17TRACK for WooCommerce: from n/a through <= 1.2.10.

Analysis

Technical impact

The 17TRACK for WooCommerce plugin contains a reflected cross‑site scripting flaw due to improper input neutralization during web page generation. This flaw allows an attacker to craft a URL or form input containing malicious JavaScript that the plugin reflects back to the victim’s browser. The vulnerability enables execution of arbitrary client‑side code with the privileges of the affected site, which could be used for defacement or phishing actions in the user’s browser.

Affected Systems

WordPress installations that include the 17TRACK for WooCommerce plugin version 1.2.10 or earlier.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a typical reflected XSS via HTTP requests to the plugin’s front‑end endpoints, requiring a victim to follow a crafted URL or submit a malicious form.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

17track

17TRACK for WooCommerce

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2.10

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the 17TRACK for WooCommerce plugin to the latest released version that removes the flaw (e.g., version 1.2.11 or later).
If an immediate upgrade is not possible, deactivate the plugin entirely until a patched version is available to eliminate the vulnerable code path.
If the plugin must remain active, restrict its public-facing endpoints to authenticated users or administrators only, for example by using rewrite rules or access‑control directives to mitigate XSS exposure.

Generated by OpenCVE AI on May 2, 2026 at 11:05 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-11637	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce allows Reflected XSS. This issue affects 17TRACK for WooCommerce: from n/a through 1.2.10.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.299% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/17track/vulnerability/wordpress-17track-for-woocommerce-plugin-1-2-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce allows Reflected XSS. This issue affects 17TRACK for WooCommerce: from n/a through 1.2.10.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce 17track allows Reflected XSS.This issue affects 17TRACK for WooCommerce: from n/a through <= 1.2.10.
References	https://patchstack.com/database/wordpress/plugin/17track/vulnerability/wordpress-17track-for-woocommerce-plugin-1-2-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/17track/vulnerability/wordpress-17track-for-woocommerce-plugin-1-2-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 17, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 17, 2025 4:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce allows Reflected XSS. This issue affects 17TRACK for WooCommerce: from n/a through 1.2.10.
Title		WordPress 17TRACK for WooCommerce Plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/17track/vulnerability/wordpress-17track-for-woocommerce-plugin-1-2-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`