CVE-2025-11821

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11821", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-15T17:29:32.050Z", "datePublished": "2025-11-11T03:30:48.891Z", "dateUpdated": "2026-04-08T17:23:36.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:36.056Z"}, "affected": [{"vendor": "elvismdev", "product": "Woocommerce \u2013 Products By Custom Tax", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Woocommerce \u2013 Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Woocommerce \u2013 Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc26607-a588-4059-9a37-afede7c9e3f6?source=cve"}, {"url": "https://wordpress.org/plugins/woocommerce-products-by-custom-tax/"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-by-custom-tax/tags/2.2/public/class-woocommerce-products-by-custom-tax-public.php#L90"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2025-11-10T15:00:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:21:01.836683Z", "id": "CVE-2025-11821", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:30:25.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11821", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T15:21:01.836683Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:21:02.582Z"}}], "cna": {"title": "Woocommerce \u2013 Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "elvismdev", "product": "Woocommerce \u2013 Products By Custom Tax", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:00:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc26607-a588-4059-9a37-afede7c9e3f6?source=cve"}, {"url": "https://wordpress.org/plugins/woocommerce-products-by-custom-tax/"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-by-custom-tax/tags/2.2/public/class-woocommerce-products-by-custom-tax-public.php#L90"}], "descriptions": [{"lang": "en", "value": "The Woocommerce \u2013 Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:36.056Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11821", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:23:36.056Z", "dateReserved": "2025-10-15T17:29:32.050Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:48.891Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Woocommerce \u2013 Products By Custom Tax", "vendor": "elvismdev", "versions": [{"lessThanOrEqual": "2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Woocommerce \u2013 Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Woocommerce - Products By Custom Tax para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'woo_products_custom_tax' en todas las versiones hasta la 2.2, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11821", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11821", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T15:21:01.836683Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:42.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-by-custom-tax/tags/2.2/public/class-woocommerce-products-by-custom-tax-public.php#L90"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/woocommerce-products-by-custom-tax/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc26607-a588-4059-9a37-afede7c9e3f6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:36:03.021365+00:00", "value": {"mitigation_remediation": ["Upgrade the WooCommerce \u2013 Products By Custom Tax plugin to a version newer than 2.2.", "If an upgrade cannot be applied immediately, revoke or downgrade contributor\u2011level permissions for users who can edit content or disable the woo_products_custom_tax shortcode in existing posts.", "Deploy a web application firewall rule that detects and blocks script payloads inserted into shortcode attributes."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the WooCommerce \u2013 Products By Custom Tax plugin by the vendor Elvismdev. All plugin versions up to and including 2.2 are affected.", "description_and_impact": "The WooCommerce \u2013 Products By Custom Tax plugin is vulnerable to stored cross\u2011site scripting through the woo_products_custom_tax shortcode. Input attributes are not properly sanitized or escaped, allowing an authenticated user with contributor\u2011level access or higher to inject arbitrary JavaScript that is saved to the page and executed whenever any visitor loads the affected content. The description does not detail the specific consequences of the injected script; it only states that the script runs in the context of legitimate users. Based on the description, the attacker must have contributor\u2011level access or higher to inject the payload.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity exposure. The EPSS score is below 1%, suggesting a low likelihood of mass exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. However, the attack requires an authenticated contributor\u2011level role; once the payload is stored it will affect all users who view the injected page. Given that the payload can affect all users who view the injected page, administrators should consider this a priority issue."}}}}, "created": "2025-11-12T12:42:58.122792+00:00", "updated": "2026-04-22T00:45:04.155224+00:00", "vendors": ["elvismdev", "elvismdev$PRODUCT$products_by_custom_tax", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}