Security readout for executives and security teams
Plain-English summary
A WordPress plugin called "Email Attachment by Order Status & Products" (versions up to 1.0.1) has a flaw that lets an attacker craft a malicious link. If a logged-in site user clicks it, the attacker can run scripts in their browser session, potentially stealing data or hijacking admin actions on the WooCommerce store.
Executive priority
Moderate priority. Patch or remove the plugin during the next maintenance window. Customer data is not directly stolen by the flaw, but a successful click-through could let an attacker hijack a store admin session and tamper with orders or content.
Technical view
CVE-2025-49957 is a Reflected Cross-Site Scripting (CWE-79) vulnerability in the Weboccult "Email Attachment by Order Status & Products" WordPress plugin through 1.0.1. CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The scope-changed vector indicates injected script executes in a different security context, typical of admin-targeted reflected XSS in WordPress plugins.
Likely exposure
Limited to WordPress/WooCommerce sites that have installed the Weboccult "Email Attachment by Order Status & Products" plugin at version 1.0.1 or earlier. Niche plugin with low installation footprint, but affected stores remain exposed until a fixed release is identified or the plugin is removed.
Exploitation context
No public reports of active exploitation and the CVE is not in CISA KEV. Exploitation requires user interaction (a target must click an attacker-supplied link) but no authentication is needed. Reflected XSS in admin-facing plugin pages is commonly chained to session theft or forced administrative actions.
Researcher notes
Sources do not name a fixed version; advisory lists "n/a through <= 1.0.1" with default status "unaffected", indicating ambiguity about a patched release. Scope:Changed plus UI:R aligns with reflected XSS landing in an admin context. Validate the exact sink and parameter via the Patchstack entry before crafting detections; avoid assuming a fix exists without vendor confirmation.
Mitigation direction
- Inventory WordPress sites for the email-attachment-by-order-status-products plugin and record installed versions.
- Disable or uninstall the plugin on affected sites until vendor guidance confirms a patched release.
- Check the Patchstack advisory and Weboccult vendor channels for an updated plugin version.
- Apply a Web Application Firewall rule to block reflected XSS payloads targeting plugin endpoints.
- Restrict WordPress admin access via IP allowlists or VPN to reduce phishing-link exposure.
- Train administrators to avoid clicking unsolicited links to wp-admin pages.
Validation and detection
- Run wp plugin list (or scan plugin directories) to identify installations of the affected plugin.
- Compare installed version to 1.0.1 and flag any equal-or-lower versions as vulnerable.
- Review the Patchstack advisory for the specific vulnerable parameter and any released fix version.
- Inspect WAF and access logs for suspicious query strings hitting plugin URLs.
- After remediation, retest by browsing plugin admin pages with reflected payload patterns blocked at the WAF.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-49957 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.