CVE-2025-15363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15363", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-12-30T13:51:48.843Z", "datePublished": "2026-03-18T06:00:09.938Z", "dateUpdated": "2026-03-18T13:33:20.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-18T06:00:09.938Z"}, "title": "Get Use APIs < 2.0.10 - Contributor+ Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Get Use APIs", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.0.10"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations."}], "references": [{"url": "https://wpscan.com/vulnerability/428d08bb-5329-4406-a785-131bae4ed085/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Ahmed Makawi", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T13:31:48.997320Z", "id": "CVE-2025-15363", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:33:20.817Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-15363", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T13:31:48.997320Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:30:33.589Z"}}], "cna": {"title": "Get Use APIs < 2.0.10 - Contributor+ Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Makawi"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Get Use APIs", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/428d08bb-5329-4406-a785-131bae4ed085/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-18T06:00:09.938Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15363", "state": "PUBLISHED", "dateUpdated": "2026-03-18T13:33:20.817Z", "dateReserved": "2025-12-30T13:51:48.843Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-03-18T06:00:09.938Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Get Use APIs", "vendor": "Unknown", "versions": [{"lessThan": "2.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations."}, {"lang": "es", "value": "El plugin de WordPress Get Use APIs anterior a la versi\u00f3n 2.0.10 ejecuta JSON importado, lo que podr\u00eda permitir a usuarios con un rol tan bajo como el de colaborador realizar ataques de cross-site scripting bajo ciertas configuraciones de servidor."}], "id": "CVE-2025-15363", "lastModified": "2026-06-17T08:37:37.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 3.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15363", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T13:31:48.997320Z", "version": "2.0.3"}}]}, "published": "2026-03-18T07:16:21.187", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/428d08bb-5329-4406-a785-131bae4ed085/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Get Use APIs", "source": "cna", "vendor": "Unknown"}, "product": "get_use_apis", "vendor": "berkux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-18T15:25:23.261099+00:00", "value": {"mitigation_remediation": ["Update the Get Use APIs plugin to version 2.0.10 or later."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw affects the Get Use APIs plugin with any release before 2.0.10, regardless of the WordPress host. Administrators should check the installed plugin version. No additional whitelist or dependences are listed.", "description_and_impact": "The Get Use APIs WordPress plugin prior to version 2.0.10 can execute JavaScript contained in imported JSON. A contributor\u2011level user can force the plugin to import a crafted JSON file, causing the site to render user\u2011supplied script. This stored XSS vulnerability can lead to session hijacking, data theft, or other client\u2011side attacks on any visitor who views the compromised content.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.9, indicating moderate severity. EPSS is below 1%, suggesting low current exploitation probability, and it is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Likely attack vectors involve a contributor uploading malicious JSON through the import feature, which is publicly accessible on the site; the necessary conditions are that the user has contributor rights and that the plugin processes the JSON without proper filtering."}}}}, "created": "2026-03-18T10:41:47.307667+00:00", "updated": "2026-03-24T10:59:16.339045+00:00", "vendors": ["berkux", "berkux$PRODUCT$get_use_apis", "wordpress", "wordpress$PRODUCT$wordpress"]}