{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1008", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-04T00:16:30.832Z", "datePublished": "2025-03-05T08:21:56.627Z", "dateUpdated": "2026-04-08T17:22:00.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:22:00.722Z"}, "affected": [{"vendor": "worldweb", "product": "Recently Purchased Products For Woo", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018view\u2019 parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160"}, {"url": "https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250357/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-03-04T19:18:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-05T14:58:27.284206Z", "id": "CVE-2025-1008", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T14:58:37.868Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-05T14:58:27.284206Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T14:58:33.966Z"}}], "cna": {"title": "Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "worldweb", "product": "Recently Purchased Products For Woo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-04T19:18:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160"}, {"url": "https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3250357/"}], "descriptions": [{"lang": "en", "value": "The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018view\u2019 parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:22:00.722Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1008", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:22:00.722Z", "dateReserved": "2025-02-04T00:16:30.832Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-05T08:21:56.627Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018view\u2019 parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Recently Purchased Products For Woo para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro \"view\" en todas las versiones hasta la 1.1.3 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1008", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-05T09:15:10.110", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3250357/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:05:47.459586+00:00", "value": {"mitigation_remediation": ["Upgrade the Recently Purchased Products For Woo plugin to the latest release that implements input sanitization for the view parameter.", "If an immediate upgrade is unavailable, prevent Contributors and higher roles from accessing or manipulating the view parameter, or disable the plugin for those roles until the issue is fixed.", "Add a custom filter to the plugin or site code that performs output escaping on the view parameter to block stored XSS while awaiting the official fix."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Recently Purchased Products For Woo plugin from the vendor worldweb, in any version up to and including 1.1.3. The flaw is independent of the WordPress core version and can be triggered on any user who has Contributor or higher access to the site.", "description_and_impact": "The Recently Purchased Products For Woo WordPress plugin is affected by stored Cross\u2011Site Scripting because the view parameter is not properly sanitized or escaped. This weakness (CWE\u201179) allows an attacker who can supply the view parameter to store malicious scripts that are rendered whenever a visitor loads the affected page. The vulnerability grants the ability to execute arbitrary client\u2011side code, potentially affecting the user experience and providing a foothold for other attacks that rely on scripted payloads.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low current chance of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks. The likely attack vector requires the attacker to authenticate with a Contributor or higher role and supply a crafted view parameter in a request that the plugin stores; the stored payload is then served to all site visitors who view the affected page."}}}}, "created": "2025-07-13T11:22:03.865040+00:00", "updated": "2026-04-21T22:15:45.900017+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}