CVE-2025-13369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13369", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T18:03:13.649Z", "datePublished": "2026-01-07T07:17:33.843Z", "dateUpdated": "2026-04-08T17:10:54.953Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:54.953Z"}, "affected": [{"vendor": "premmerce", "product": "Premmerce WooCommerce Customers Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link."}], "title": "Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9980ec20-60ae-42eb-a2cd-146e57435398?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/src/Admin/Admin.php#L135"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/src/Admin/Admin.php#L135"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/views/admin/filter.php#L43"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/views/admin/filter.php#L43"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465273/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2026-01-06T18:36:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:50:12.714992Z", "id": "CVE-2025-13369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:13:15.887Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:50:12.714992Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:50:15.256Z"}}], "cna": {"title": "Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "premmerce", "product": "Premmerce WooCommerce Customers Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T18:36:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9980ec20-60ae-42eb-a2cd-146e57435398?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/src/Admin/Admin.php#L135"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/src/Admin/Admin.php#L135"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/views/admin/filter.php#L43"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/views/admin/filter.php#L43"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465273/"}], "descriptions": [{"lang": "en", "value": "The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:54.953Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13369", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:54.953Z", "dateReserved": "2025-11-18T18:03:13.649Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T07:17:33.843Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Premmerce WooCommerce Customers Manager", "vendor": "premmerce", "versions": [{"lessThanOrEqual": "1.1.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Premmerce WooCommerce Customers Manager para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s de los par\u00e1metros 'money_spent_from', 'money_spent_to', 'registered_from' y 'registered_to' en todas las versiones hasta la 1.1.14, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida inadecuado. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13369", "lastModified": "2026-06-17T08:34:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:50:12.714992Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:47.430", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/src/Admin/Admin.php#L135"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/tags/1.1.14/views/admin/filter.php#L43"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/src/Admin/Admin.php#L135"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-customers-manager/trunk/views/admin/filter.php#L43"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3465273/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9980ec20-60ae-42eb-a2cd-146e57435398?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:46:21.795227+00:00", "value": {"mitigation_remediation": ["Upgrade Premmerce WooCommerce Customers Manager to version 1.1.15 or later, which removes the reflected XSS vulnerability.", "If an upgrade cannot be performed immediately, disable the plugin in the WordPress admin until it can be patched to prevent use of the vulnerable filter fields.", "Implement proper input validation and output escaping on the admin interface \u2013 for example, use WordPress sanitization functions such as esc_html() or sanitize_text_field() to cleanse all incoming query parameters."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This flaw affects WordPress installations running Premmerce WooCommerce Customers Manager version 1.1.14 or earlier. The affected component is the admin interface that processes the four query parameters mentioned above.\n", "description_and_impact": "The Premmerce WooCommerce Customers Manager plugin contains a reflected cross\u2011site scripting flaw that allows any user to inject unwanted JavaScript via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to 1.1.14. The vulnerability is caused by insufficient input sanitization and output escaping. An attacker who can trick an administrator into loading a crafted link can cause the browser to execute the injected script, potentially leading to session hijacking, credential theft, or other client\u2011side attacks. The weakness is catalogued as CWE\u201179.\n", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, while the EPSS of less than 1% suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a phishing style attack, where an unauthenticated attacker directs an admin to a malicious link containing the crafted parameters. The administrator\u2019s browser would then execute the injected script.\n"}}}}, "created": "2026-01-08T09:49:47.287530+00:00", "updated": "2026-04-21T17:00:12.306798+00:00", "vendors": ["premmerce", "premmerce$PRODUCT$woocommerce_customers_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}