{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1560", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-21T16:35:58.320Z", "datePublished": "2025-02-28T08:23:14.044Z", "dateUpdated": "2026-04-08T16:48:51.815Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:51.815Z"}, "affected": [{"vendor": "darkosxrc", "product": "WOW Entrance Effects (WEE!)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-entrance-effects-wee/trunk/wee.php"}, {"url": "https://wordpress.org/plugins/wow-entrance-effects-wee/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2025-02-27T20:10:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T13:53:51.193657Z", "id": "CVE-2025-1560", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T13:54:12.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T13:53:51.193657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T13:54:06.837Z"}}], "cna": {"title": "WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "darkosxrc", "product": "WOW Entrance Effects (WEE!)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-27T20:10:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-entrance-effects-wee/trunk/wee.php"}, {"url": "https://wordpress.org/plugins/wow-entrance-effects-wee/"}], "descriptions": [{"lang": "en", "value": "The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:51.815Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1560", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:51.815Z", "dateReserved": "2025-02-21T16:35:58.320Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-28T08:23:14.044Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-1560", "lastModified": "2025-02-28T09:15:12.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2025-02-28T09:15:12.040", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wow-entrance-effects-wee/trunk/wee.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wow-entrance-effects-wee/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:12:09.819376+00:00", "value": {"mitigation_remediation": ["Update WOW Entrance Effects to the latest release that resolves the XSS issue.", "If an update is not immediately available, disable the plugin or restrict the \u2018wee\u2019 shortcode to administrator users only.", "As an interim defensive measure, employ WordPress\u2019s wp_kses or a similar sanitisation function to cleanse shortcode attributes before rendering the content."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw exists in all releases of WOW Entrance Effects (WEE!) up to and including version 0.1, distributed by the vendor darkosxrc. WordPress sites that have installed this plugin and have at least contributor\u2011level accounts are affected.", "description_and_impact": "The WOW Entrance Effects (WEE!) WordPress plugin contains a stored cross\u2011site scripting flaw. A contributor\u2011level or higher authenticated user can inject arbitrary JavaScript through the plugin\u2019s \u2018wee\u2019 shortcode by supplying malicious attributes that are neither sanitized nor escaped. The injected scripts run under the context of any visitor who loads the affected page, enabling credential theft, defacement, or further exploitation of the site. This vulnerability is solely exploitable by authenticated users with contributor permissions or higher, and requires that the attacker be able to add or modify content that contains the shortcode.", "risk_and_exploitability": "With a CVSS score of 6.4 the vulnerability is of moderate severity. The EPSS score is below 1\u202f%, suggesting that exploit activity has historically been rare, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, once an account with contributor or higher privileges is compromised, an attacker can inject persistent scripts that execute whenever a page containing the shortcode is viewed. The attack vector is authenticated via normal WordPress usage, leveraging the plugin\u2019s shortcode processing."}}}}, "created": "2025-07-12T22:16:21.207445+00:00", "updated": "2026-04-21T22:15:45.905198+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}