CVE-2025-13974

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13974", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T16:03:59.763Z", "datePublished": "2026-01-07T09:21:03.804Z", "dateUpdated": "2026-04-08T17:21:13.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:13.459Z"}, "affected": [{"vendor": "themehigh", "product": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in email templates that will execute when customers view transactional emails. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6927b4f-f47e-47fc-a5bf-b7fa42c31412?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/tags/2.6.7/classes/inc/class-wecmf-general-template.php#L213"}, {"url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/trunk/classes/inc/class-wecmf-general-template.php#L213"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455187/#file6"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Andrii Kaspir"}], "timeline": [{"time": "2026-01-06T20:40:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:54:16.720503Z", "id": "CVE-2025-13974", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:55:40.975Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13974", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:54:16.720503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:54:20.975Z"}}], "cna": {"title": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content", "credits": [{"lang": "en", "type": "finder", "value": "Andrii Kaspir"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "themehigh", "product": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.6.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T20:40:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6927b4f-f47e-47fc-a5bf-b7fa42c31412?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/tags/2.6.7/classes/inc/class-wecmf-general-template.php#L213"}, {"url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/trunk/classes/inc/class-wecmf-general-template.php#L213"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455187/#file6"}], "descriptions": [{"lang": "en", "value": "The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in email templates that will execute when customers view transactional emails. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:13.459Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13974", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:13.459Z", "dateReserved": "2025-12-03T16:03:59.763Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T09:21:03.804Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder", "vendor": "themehigh", "versions": [{"lessThanOrEqual": "2.6.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in email templates that will execute when customers view transactional emails. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Email Customizer para WooCommerce para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del contenido de las plantillas de correo electr\u00f3nico en todas las versiones hasta e incluyendo la 2.6.7, debido a una sanitizaci\u00f3n insuficiente de la entrada y un escape de la salida. Esto permite a atacantes autenticados, con acceso de nivel de administrador, inyectar scripts web arbitrarios en las plantillas de correo electr\u00f3nico que se ejecutar\u00e1n cuando los clientes vean los correos electr\u00f3nicos transaccionales. Esto solo afecta a las instalaciones multisitio y a las instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-13974", "lastModified": "2026-06-17T08:35:06.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13974", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:54:16.720503Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:50.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/tags/2.6.7/classes/inc/class-wecmf-general-template.php#L213"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/email-customizer-for-woocommerce/trunk/classes/inc/class-wecmf-general-template.php#L213"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3455187/#file6"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6927b4f-f47e-47fc-a5bf-b7fa42c31412?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:36:09.744042+00:00", "value": {"mitigation_remediation": ["Upgrade the Email Customizer for WooCommerce plugin to the latest available version that contains a fix for the stored XSS vulnerability.", "If an upgrade is not immediately possible, temporarily disable or delete the existing email templates that contain custom content until a patched version is installed.", "As a last\u2011resort workaround, modify the plugin\u2019s template saving logic to apply wp_kses_post() or similar sanitization to the template content before storage, ensuring that only safe HTML is persisted."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (CWE\u201179)"}, "threat_synthesis": {"affected_systems": "The flaw exists in all versions of the Email Customizer for WooCommerce plugin up to and including 2.6.7. Users of the plugin on multi\u2011site WordPress installations where the unfiltered_html role capability is removed are impacted. The issue does not affect single\u2011site setups or instances where unfiltered_html remains enabled.", "description_and_impact": "The vulnerability allows an authenticated administrator to inject arbitrary JavaScript into the content of email templates. The injected script is stored by the plugin and executed each time customers view transactional emails. This flaw is an instance of improper output encoding (CWE\u201179) and is reflected in a CVSS score of 4.4.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, and the EPSS score (<1%) suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrator privileges and the ability to edit email templates; once injected, the malicious script runs in the browsers of customers reading the email."}}}}, "created": "2026-01-08T09:49:12.804395+00:00", "updated": "2026-04-21T16:45:15.213555+00:00", "vendors": ["themehigh", "themehigh$PRODUCT$email_customizer_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}