{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9061", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T12:27:38.754Z", "datePublished": "2025-09-09T05:25:42.900Z", "dateUpdated": "2026-04-08T16:53:11.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:11.341Z"}, "affected": [{"vendor": "Mikado Themes", "product": "Wilmer Core", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve"}, {"url": "https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-08-15T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-08-22T16:12:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-08T17:14:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-09T19:25:06.486847Z", "id": "CVE-2025-9061", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-09T19:25:13.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9061", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-09T19:25:06.486847Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-09T19:25:10.769Z"}}], "cna": {"title": "Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "Mikado Themes", "product": "Wilmer Core", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.4.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-15T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-08-22T16:12:49.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-08T17:14:35.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve"}, {"url": "https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848"}], "descriptions": [{"lang": "en", "value": "The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-09T05:25:42.900Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9061", "state": "PUBLISHED", "dateUpdated": "2025-09-09T19:25:13.958Z", "dateReserved": "2025-08-15T12:27:38.754Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-09T05:25:42.900Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9061", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-09T06:15:35.263", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:10:35.326579+00:00", "value": {"mitigation_remediation": ["Upgrade Wilmer Core to a version newer than 2.4.5 to obtain the input sanitization fix.", "If an upgrade is not immediately possible, limit or remove contributor permissions that can create or edit shortcodes or disable shortcode usage for contributors.", "Review existing pages using Wilmer Core shortcodes and remove any unexpected or suspicious script attributes from the content and database."], "summary": {"action": "Update", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Mikado Themes:Wilmer Core. All releases through version 2.4.5 are affected. No other vendors or product versions are listed as impacted.", "description_and_impact": "The Wilmer Core plugin for WordPress is vulnerable to stored cross\u2011site scripting via shortcodes in versions up to and including 2.4.5. The flaw arises because attributes supplied by users in shortcode tags are neither sanitized nor escaped before being stored, allowing an authenticated attacker with contributor\u2011level or higher permissions to embed arbitrary JavaScript that will be executed when another user views the page containing the malicious shortcode.", "risk_and_exploitability": "The CVSS score for this vulnerability is 6.4, indicating moderate severity. The EPSS score is less than 1\u202f%, suggesting a low probability of exploitation at this time, although the flaw remains publicly available. The issue is not listed in the CISA KEV catalog. The attack requires that the attacker has authenticated contributor\u2011level (or higher) access to the site, and once the malicious code is stored it runs for any visitor to the compromised page."}}}}, "created": "2025-09-09T21:31:36.288332+00:00", "updated": "2026-04-21T19:15:26.038678+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}