{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15486", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-08T10:32:11.060Z", "datePublished": "2026-01-14T05:28:13.753Z", "dateUpdated": "2026-04-08T17:33:47.043Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:47.043Z"}, "affected": [{"vendor": "kunzemarketing", "product": "Kunze Law", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nAdditional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server."}], "title": "Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7957619-e562-4043-920d-275c58684328?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L531"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ZAST.AI"}], "timeline": [{"time": "2025-12-14T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-13T16:42:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T21:05:06.359539Z", "id": "CVE-2025-15486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:06:06.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T21:05:06.359539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:05:18.188Z"}}], "cna": {"title": "Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "ZAST.AI"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "kunzemarketing", "product": "Kunze Law", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-14T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-13T16:42:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7957619-e562-4043-920d-275c58684328?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L406"}, {"url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L531"}], "descriptions": [{"lang": "en", "value": "The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nAdditional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:47.043Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15486", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:47.043Z", "dateReserved": "2026-01-08T10:32:11.060Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T05:28:13.753Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nAdditional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server."}, {"lang": "es", "value": "El plugin Kunze Law para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode del plugin en todas las versiones hasta la 2.1, inclusive, debido a que el plugin obtiene contenido HTML de un servidor remoto y lo inyecta en las p\u00e1ginas sin ninguna sanitizaci\u00f3n o escape. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde unfiltered_html ha sido deshabilitado.\nLa presencia adicional de una vulnerabilidad de salto de ruta en el nombre del shortcode permite escribir archivos HTML maliciosos en ubicaciones arbitrarias con permisos de escritura en el servidor."}], "id": "CVE-2025-15486", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-14T06:15:54.597", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L406"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kunze-law/tags/2.1/kunze-law.php#L531"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7957619-e562-4043-920d-275c58684328?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:26:10.585020+00:00", "value": {"mitigation_remediation": ["Disable or remove the Kunze Law plugin if it is not required for site functionality", "Delete or manually sanitize any shortcode entries that contain injected script or unintended HTML stored in the database", "Ensure that the WordPress option unfiltered_html is disabled for all users other than administrators and consider adding a content sanitization layer or plugin to escape output from the shortcode"], "summary": {"action": "Disable Plugin", "impact": "Stored Cross\u2011Site Scripting with administrator privileges"}, "threat_synthesis": {"affected_systems": "WordPress sites running Kunze Law versions through 2.1, including multisite installations or sites where the option unfiltered_html is disabled, are affected. Only users with Administrator (or higher) privileges can achieve the injection, yet the resulting compromised content is visible to all users who view the page.", "description_and_impact": "The Kunze Law WordPress plugin contains a stored cross\u2011site scripting flaw that allows a user with Administrator\u2011level access to embed arbitrary JavaScript within the plugin\u2019s shortcode. The plugin fetches HTML from a remote server and writes the response directly into a page without sanitization or escaping, meaning the malicious script will run whenever any visitor loads the affected page. The same shortcode also suffers a path\u2011traversal weakness that lets the attacker create or overwrite files in any server location that is writable by the web server process, potentially allowing the deployment of additional malicious artifacts such as HTML or PHP files.", "risk_and_exploitability": "The CVSS score of 4.4 denotes low severity, and the EPSS score of less than 1% indicates that exploitation is highly unlikely in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. An attacker must first obtain Administrator access to the site to trigger the flaw; once achieved, stored scripts will execute for every user visiting the content, and the path\u2011traversal flaw can be used to write arbitrary files, potentially expanding the attack surface. The overall risk is moderate in environments where administrators cannot be fully trusted, but remains low for most deployments due to the elevated\u2011privilege prerequisite."}}}}, "created": "2026-01-14T10:48:26.595666+00:00", "updated": "2026-04-21T00:30:22.976059+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}