CVE-2025-0864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0864", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-29T21:28:02.044Z", "datePublished": "2025-02-18T07:28:14.895Z", "dateUpdated": "2026-04-08T17:34:08.705Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:08.705Z"}, "affected": [{"vendor": "realmag777", "product": "Active Products Tables for WooCommerce. Use constructor to create tables", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.6.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f93dcb51-1caf-4d63-a8f3-f6251dd0d19f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1624"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235888%40profit-products-tables-for-woocommerce&new=3235888%40profit-products-tables-for-woocommerce&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Brian Sans-Souci"}], "timeline": [{"time": "2025-02-17T19:21:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-18T15:19:55.960296Z", "id": "CVE-2025-0864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T15:20:06.542Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-18T15:19:55.960296Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T15:20:01.755Z"}}], "cna": {"title": "Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Brian Sans-Souci"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "realmag777", "product": "Active Products Tables for WooCommerce. Use constructor to create tables", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.6.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-17T19:21:09.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f93dcb51-1caf-4d63-a8f3-f6251dd0d19f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1624"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235888%40profit-products-tables-for-woocommerce&new=3235888%40profit-products-tables-for-woocommerce&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:08.705Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0864", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:08.705Z", "dateReserved": "2025-01-29T21:28:02.044Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-18T07:28:14.895Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Active Products Tables for WooCommerce. Use constructor to create tables", "vendor": "realmag777", "versions": [{"lessThanOrEqual": "1.0.6.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluginus:active_products_tables_for_woocommerce:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "D82DF547-93E9-42AC-8AED-9839A6E82EA6", "versionEndExcluding": "1.0.6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Active Products Tables for WooCommerce. Use constructor to create tables para WordPress es vulnerable a Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro 'Shortcodes_Set' en todas las versiones hasta 1.0.6.6 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto hace posible que los atacantes no autenticados inyecten una web arbitraria scripts en p\u00e1ginas que ejecutan si pueden enga\u00f1ar con \u00e9xito a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-0864", "lastModified": "2026-06-17T08:27:16.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-18T15:19:55.960296Z", "version": "2.0.3"}}]}, "published": "2025-02-18T08:15:10.723", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1624"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L88"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235888%40profit-products-tables-for-woocommerce&new=3235888%40profit-products-tables-for-woocommerce&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f93dcb51-1caf-4d63-a8f3-f6251dd0d19f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:21:08.832911+00:00", "value": {"mitigation_remediation": ["Upgrade the Active Products Tables for WooCommerce plugin to any version newer than 1.0.6.6 that addresses the XSS issue.", "If an update is not yet available, disable or remove the shortcode that processes the 'shortcodes_set' parameter, or completely uninstall the plugin to eliminate the attack surface.", "Add a strict Content Security Policy (CSP) header that blocks inline scripts on the affected pages to mitigate potential XSS payloads until the plugin issue is resolved."], "summary": {"action": "Patch", "impact": "Reflected Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw affects the WordPress plugin RealMag777\u2019s Active Products Tables for WooCommerce, versions up to and including 1.0.6.6. Targets are sites running any WordPress installation with the plugin installed and the shortcode active. The vulnerability is present in the plugin's source file referenced in the official WordPress repository.", "description_and_impact": "The vulnerability allows attackers to inject arbitrary scripts into pages served by WordPress sites that use the Active Products Tables for WooCommerce plugin. By supplying malicious content in the 'shortcodes_set' parameter, an unauthenticated user can cause an innocent visitor to execute scripts when they view a page containing the shortcode. This result is a classic reflected XSS that can compromise client-side data, facilitate phishing, or provide a foothold for further cookie-stealing attacks.", "risk_and_exploitability": "The CVSS score of 6.1 classifies the vulnerability as medium severity, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. Because access requires an unauthenticated user to persuade another visitor to click a crafted link, the attack vector is user interaction \u2013 it is not remotely exploitable without human collaboration. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported yet."}}}}, "created": "2026-04-21T22:30:06.131601+00:00", "updated": "2026-04-21T22:30:06.131612+00:00", "vendors": []}