{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1405", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-17T20:53:18.149Z", "datePublished": "2025-02-28T07:03:46.974Z", "dateUpdated": "2026-04-08T17:20:16.030Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:16.030Z"}, "affected": [{"vendor": "implecode", "product": "Product Catalog Simple", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9?source=cve"}, {"url": "https://wordpress.org/plugins/post-type-x/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246414/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "timeline": [{"time": "2025-02-27T18:52:31.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T14:51:15.124196Z", "id": "CVE-2025-1405", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T14:51:37.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1405", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T14:51:15.124196Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T14:51:25.541Z"}}], "cna": {"title": "Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "implecode", "product": "Product Catalog Simple", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-27T18:52:31.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9?source=cve"}, {"url": "https://wordpress.org/plugins/post-type-x/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246414/"}], "descriptions": [{"lang": "en", "value": "The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:16.030Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1405", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:20:16.030Z", "dateReserved": "2025-02-17T20:53:18.149Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-28T07:03:46.974Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:implecode:product_catalog_simple:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "1CD0F864-C574-417C-84AE-CEE4A78B21EF", "versionEndExcluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Product Catalog Simple para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del c\u00f3digo abreviado show_products del complemento en todas las versiones hasta la 1.7.11 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1405", "lastModified": "2025-03-06T17:52:55.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-28T07:15:34.063", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3246414/"}, {"source": "security@wordfence.com", "tags": ["Product", "Release Notes"], "url": "https://wordpress.org/plugins/post-type-x/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T02:02:24.035769+00:00", "value": {"mitigation_remediation": ["Update Product Catalog Simple to version 1.7.12 or newer, which removes the CWE\u201179 vulnerability by sanitizing shortcode attributes.", "If an update is not possible immediately, temporarily disable or remove the show_products shortcode from all public content to mitigate the stored script execution.", "Ensure that any custom shortcode usage enforces input sanitization, per CWE\u201179 guidelines, and that contributors are instructed not to supply untrusted attributes."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (arbitrary script injection in content pages)"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the implecode Product Catalog Simple plugin installed with a version of 1.7.11 or earlier. The vulnerability exists across all platforms where the plugin is active.", "description_and_impact": "The Product Catalog Simple plugin for WordPress is vulnerable to stored cross\u2011site scripting through its show_products shortcode in all releases up to and including 1.7.11. The flaw is a CWE\u201179 (Cross\u2011Site Scripting) vulnerability caused by insufficient sanitization of user\u2011supplied attributes, which allows an authenticated contributor or higher to inject arbitrary JavaScript that is persisted in the database and executed whenever any visitor views a page containing the shortcode. This can result in session hijacking, defacement, or execution of additional malicious payloads on the client side.", "risk_and_exploitability": "The CVSS score of 6.4 denotes moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present. Because the attack requires authenticated access at contributor level or higher, an attacker must first compromise credentials or infiltrate a legitimate user account with those privileges. The flaw is not listed in CISA\u2019s KEV catalog."}}}}, "created": "2026-04-22T02:15:05.409329+00:00", "updated": "2026-04-22T02:15:05.409341+00:00", "vendors": []}