{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14875", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-18T09:32:06.313Z", "datePublished": "2026-01-07T06:35:58.262Z", "dateUpdated": "2026-04-08T16:33:39.628Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:39.628Z"}, "affected": [{"vendor": "hblpay", "product": "HBLPAY Payment Gateway for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cusdata\u2019 parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06362518-f2ee-485f-9e0e-1b1ada9c72db?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438316/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-12-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-06T18:34:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:52:39.966779Z", "id": "CVE-2025-14875", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:23.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:52:39.966779Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:52:42.298Z"}}], "cna": {"title": "HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hblpay", "product": "HBLPAY Payment Gateway for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-06T18:34:42.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06362518-f2ee-485f-9e0e-1b1ada9c72db?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438316/"}], "descriptions": [{"lang": "en", "value": "The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cusdata\u2019 parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:39.628Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14875", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:33:39.628Z", "dateReserved": "2025-12-18T09:32:06.313Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T06:35:58.262Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cusdata\u2019 parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "id": "CVE-2025-14875", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-07T12:16:57.327", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3438316/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06362518-f2ee-485f-9e0e-1b1ada9c72db?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:17:10.496817+00:00", "value": {"mitigation_remediation": ["Upgrade HBLPAY Payment Gateway for WooCommerce to the latest released version that includes sanitization for the cusdata input.", "If an upgrade cannot be performed immediately, force sanitization of the cusdata parameter by applying WordPress\u2019s sanitize_text_field() or similar functions before storing or rendering it, and ensure any output uses esc_html() to escape user\u2011supplied data.", "Run a full site vulnerability scan and monitor for any XSS payloads that may still be executing, and consider deploying a WAF rule that blocks injection attempts targeting the cusdata parameter."], "summary": {"action": "Patch immediately", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all HBLPAY Payment Gateway for WooCommerce releases up to and including version 5.0.0. Sites that use any of those versions are affected; newer versions released after 5.0.0 are assumed to have addressed the issue.", "description_and_impact": "The HBLPAY Payment Gateway for WooCommerce plugin is vulnerable to a reflected Cross\u2011Site Scripting flaw that enables an unauthenticated attacker to insert arbitrary scripts via the cusdata parameter. When a victim receives a URL containing malicious data in that parameter, the plugin echoes the value back to the page without sufficient sanitization or escaping, causing the browser to execute the injected code. The CVE description does not detail additional consequences beyond client\u2011side script execution.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Based on the description, the likely attack vector is an unauthenticated user constructing a URL with malicious payload for the cusdata parameter and persuading a victim to click it. The flaw is not listed in the CISA KEV catalog, but it remains a client\u2011side vulnerability that should be mitigated."}}}}, "created": "2026-01-08T09:49:50.449316+00:00", "updated": "2026-04-22T20:30:26.767015+00:00", "vendors": ["hblpay", "hblpay$PRODUCT$payment_gateway_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}