CVE-2025-1690

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1690", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-25T11:29:32.963Z", "datePublished": "2025-02-27T08:22:03.600Z", "dateUpdated": "2026-04-08T17:27:55.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:55.884Z"}, "affected": [{"vendor": "ThemeMakers", "product": "ThemeMakers Stripe Checkout", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd040ff7-7f30-4097-9492-743a9821589e?source=cve"}, {"url": "https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708"}, {"url": "https://github.com/ThemeMakers/tmm_stripe_checkout/compare/v1.0.1...v1.0.2"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-25T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-27T14:37:21.383150Z", "id": "CVE-2025-1690", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:37:29.303Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1690", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-25T11:29:32.963Z", "datePublished": "2025-02-27T08:22:03.600Z", "dateUpdated": "2025-02-27T14:37:29.303Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-02-27T08:22:03.600Z"}, "affected": [{"vendor": "ThemeMakers", "product": "ThemeMakers Stripe Checkout", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd040ff7-7f30-4097-9492-743a9821589e?source=cve"}, {"url": "https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708"}, {"url": "https://github.com/ThemeMakers/tmm_stripe_checkout/compare/v1.0.1...v1.0.2"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-25T00:00:00.000+00:00", "lang": "en", "value": "Discovered"}, {"time": "2025-02-25T00:00:00.000+00:00", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-26T00:00:00.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-27T14:37:21.383150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:37:25.126Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ThemeMakers Stripe Checkout", "vendor": "ThemeMakers", "versions": [{"lessThanOrEqual": "1.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thememakers:stripe_checkout:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "AD3C87FA-58C4-40BC-B8F6-273464CC2F92", "versionEndExcluding": "1.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Stripe Checkout de ThemeMakers para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del c\u00f3digo corto \"stripe\" en versiones hasta la 1.0.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1690", "lastModified": "2026-06-17T08:39:36.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1690", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-27T14:37:21.383150Z", "version": "2.0.3"}}]}, "published": "2025-02-27T09:15:10.697", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://github.com/ThemeMakers/tmm_stripe_checkout/compare/v1.0.1...v1.0.2"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd040ff7-7f30-4097-9492-743a9821589e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:46:45.402983+00:00", "value": {"mitigation_remediation": ["Upgrade the ThemeMakers Stripe Checkout plugin to version 1.0.2 or newer to receive the vendor\u2019s fix.", "If an upgrade is not immediately possible, strip the \"stripe\" shortcode from all posts and pages or disable its execution engine until the patch is applied.", "Ensure that only trusted administrators have Contributor or higher roles; apply least\u2011privilege principles to restrict who can edit content containing the shortcode."], "summary": {"action": "Patch Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of the ThemeMakers Stripe Checkout plugin for WordPress with versions up to and including 1.0.1 are affected. The plugin is available on WordPress.com and self\u2011hosted WordPress sites, and it may appear as part of themes or theme\u2011marketplace bundles.", "description_and_impact": "The ThemeMakers Stripe Checkout WordPress plugin is vulnerable to stored cross\u2011site scripting through its \"stripe\" shortcode. Improper input sanitization and output escaping allow an authenticated user with Contributor\u2011level or higher permissions to embed arbitrary script code. When a user accesses a page containing the malicious shortcode, the injected script executes in the victim\u2019s browser, potentially leading to session hijack, credential theft, defacement, or other malicious behaviors. This flaw corresponds to CWE\u201179, a classic reflected or stored XSS weakness.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate\u2011to\u2011high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must first obtain contributor or higher privileges on the site, then add or edit a page that uses the vulnerable shortcode. Once installed, the injected scripts will execute for all visitors to that page, making it a persistent threat for sites that have not patched or mitigated the vulnerability."}}}}, "created": "2026-04-21T00:00:13.354653+00:00", "updated": "2026-04-21T00:00:13.354673+00:00", "vendors": []}