CVE-2025-10191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10191", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-09T15:55:44.110Z", "datePublished": "2025-09-30T03:35:28.922Z", "dateUpdated": "2026-04-08T17:11:27.925Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:27.925Z"}, "affected": [{"vendor": "fusedsoftware", "product": "Big Post Shipping for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad27cd-b4cc-4f34-8588-130e1ba997f9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-bigpost-shipping/trunk/includes/class-woobigpost-shortcodes.php#L36"}, {"url": "https://wordpress.org/plugins/woo-bigpost-shipping"}, {"url": "https://plugins.trac.wordpress.org/changeset/3370259/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-09-29T15:21:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:29:16.924518Z", "id": "CVE-2025-10191", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:29:32.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T15:29:16.924518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:29:22.401Z"}}], "cna": {"title": "Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "fusedsoftware", "product": "Big Post Shipping for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T15:21:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad27cd-b4cc-4f34-8588-130e1ba997f9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-bigpost-shipping/trunk/includes/class-woobigpost-shortcodes.php#L36"}, {"url": "https://wordpress.org/plugins/woo-bigpost-shipping"}, {"url": "https://plugins.trac.wordpress.org/changeset/3370259/"}], "descriptions": [{"lang": "en", "value": "The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:27.925Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10191", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:27.925Z", "dateReserved": "2025-09-09T15:55:44.110Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-30T03:35:28.922Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Big Post Shipping for WooCommerce", "vendor": "fusedsoftware", "versions": [{"lessThanOrEqual": "2.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Big Post Shipping para WooCommerce para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'wooboigpost_shipping_status' del plugin en todas las versiones hasta la 2.1.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-10191", "lastModified": "2026-10-09T09:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10191", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:29:16.924518Z", "version": "2.0.3"}}]}, "published": "2025-09-30T11:37:38.193", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-bigpost-shipping/trunk/includes/class-woobigpost-shortcodes.php#L36"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3370259/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/woo-bigpost-shipping"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad27cd-b4cc-4f34-8588-130e1ba997f9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:17:37.068071+00:00", "value": {"mitigation_remediation": ["Update the Big Post Shipping plugin to the latest version, which removes the vulnerable shortcode processing.", "Restrict access to the Contributor role to trusted personnel only, or remove the role if unnecessary.", "If an immediate update is not feasible, delete or disable the wooboigpost_shipping_status shortcode handler or apply a filter that escapes attributes for all posts that use the shortcode."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting (Contributor+)"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Big Post Shipping for WooCommerce plugin from fusedsoftware version 2.1.2 or earlier are affected. The flaw resides in the plugin\u2019s shortcode implementation and is unrelated to the core WordPress software. Sites that have upgraded past version 2.1.2 or that never installed the plugin are not impacted.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw in the wooboigpost_shipping_status shortcode of the Big Post Shipping for WooCommerce plugin. Insufficient input sanitization and output escaping allow authenticated users with contributor level or higher to inject arbitrary scripts via the shortcode\u2019s attributes. When a page containing the shortcode is rendered, the injected scripts execute in the browsers of any user who views that page, potentially enabling credential theft, session hijacking, defacement, or other malicious actions.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the required attack vector is authenticated; an attacker must possess a contributor\u2011level or higher account, reducing the overall threat compared to publicly exploitable flaws."}}}}, "created": "2025-09-30T08:47:24.449708+00:00", "updated": "2026-04-22T13:30:17.917266+00:00", "vendors": ["fusedsoftware", "fusedsoftware$PRODUCT$big_post_shipping_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}