CVE-2025-58228

MediumCVSS 6.5

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Quick View for WooCommerce plugin up to version 2.2.16 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.

Risk Assessment

An attacker can inject a persistent malicious script that executes on every page view, potentially leading to admin account takeover or data theft.

Recommendation

Update the Quick View for WooCommerce plugin to the latest version that includes a security fix.

Other vulnerabilities in Quick View for WooCommerce

CVE-2025-12584Medium
The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This allows unauthenticated attackers to extract data from private products they should not access.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS