CVE-2025-12964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12964", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-10T17:18:10.990Z", "datePublished": "2025-11-21T09:27:00.601Z", "dateUpdated": "2026-04-08T17:01:20.892Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:20.892Z"}, "affected": [{"vendor": "nalam-1", "product": "Magical Shop Builder \u2013 WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/758e23b9-c3d5-4f1c-9659-66483d6f0578?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2149"}, {"url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2167"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394768%40magical-products-display&new=3394768%40magical-products-display&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}], "timeline": [{"time": "2025-11-13T03:27:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-20T20:44:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T14:47:49.097370Z", "id": "CVE-2025-12964", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:55:20.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T14:47:49.097370Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:53:38.584Z"}}], "cna": {"title": "Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget", "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "nalam-1", "product": "Magical Products Display \u2013 Elementor WooCommerce Widgets | Product Sliders, Grids & AJAX Search", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.29"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-13T03:27:42.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-20T20:44:27.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/758e23b9-c3d5-4f1c-9659-66483d6f0578?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2149"}, {"url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2167"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394768%40magical-products-display&new=3394768%40magical-products-display&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-21T09:27:00.601Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12964", "state": "PUBLISHED", "dateUpdated": "2025-11-21T14:55:20.219Z", "dateReserved": "2025-11-10T17:18:10.990Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-21T09:27:00.601Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Magical Shop Builder \u2013 WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder", "vendor": "nalam-1", "versions": [{"lessThanOrEqual": "1.1.29", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Magical Products Display para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los par\u00e1metros 'mpdpr_title_tag' y 'mpdpr_subtitle_tag' en el widget MPD Pricing Table en todas las versiones hasta la 1.1.29, inclusive, debido a la sanitizaci\u00f3n de entrada y el escape de salida insuficientes en los nombres de etiquetas HTML proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-12964", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12964", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T14:47:49.097370Z", "version": "2.0.3"}}]}, "published": "2025-11-21T10:15:48.400", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2149"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/magical-products-display/tags/1.1.29/includes/widgets/pricing-table.php#L2167"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394768%40magical-products-display&new=3394768%40magical-products-display&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/758e23b9-c3d5-4f1c-9659-66483d6f0578?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:30:00.795430+00:00", "value": {"mitigation_remediation": ["Apply any available update that patches this stored XSS flaw.", "If an update is unavailable, disable the MPD Pricing Table widget or restrict contributors from editing the widget\u2019s title and subtitle tag settings.", "Implement a Content Security Policy that blocks inline scripts and restricts script sources to mitigate the risk."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of Magical Products Display plugin for WordPress through version 1.1.29 are affected. The vulnerability applies to the plugin\u2019s pricing table widget that can be activated on product, shop, or checkout pages via the WooCommerce Elementor template builder.", "description_and_impact": "The Magical Products Display plugin (WordPress) contains a stored cross\u2011site scripting flaw in the MPD Pricing Table widget. When a contributor\u2011level user edits the widget, the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters are not sanitized or escaped, allowing arbitrary HTML tags and embedded scripts to be stored. Any site visitor who accesses a page containing the run the injected script in their browser, enabling data theft, defacement or credential compromise.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests low exploitation probability. The attack requires an authenticated user with Contributor or higher privileges, limiting the threat surface. However, once the contributor role is compromised, the injected script can affect every site visitor, extracting cookies or performing phishing operations. The vulnerability is not currently listed in the CISA KEV catalog."}}}}, "created": "2025-11-24T09:10:03.770365+00:00", "updated": "2026-04-22T00:30:04.057702+00:00", "vendors": ["nalam-1", "nalam-1$PRODUCT$magical_products_display", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}