CVE-2025-3878

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3878", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-22T17:05:28.908Z", "datePublished": "2025-05-10T11:22:46.479Z", "dateUpdated": "2026-04-08T17:13:51.975Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:51.975Z"}, "affected": [{"vendor": "cozyvision1", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a85461b7-6d16-435c-a149-ad25419a1585?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/helper/shortcode.php#L103"}, {"url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3290478/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-05-09T21:58:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-12T11:53:24.225783Z", "id": "CVE-2025-3878", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T13:19:49.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3878", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-12T11:53:24.225783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T13:19:45.641Z"}}], "cna": {"title": "SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "cozyvision1", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-09T21:58:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a85461b7-6d16-435c-a149-ad25419a1585?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/helper/shortcode.php#L103"}, {"url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3290478/"}], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:51.975Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3878", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:13:51.975Z", "dateReserved": "2025-04-22T17:05:28.908Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-10T11:22:46.479Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "vendor": "cozyvision1", "versions": [{"lessThanOrEqual": "3.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "FC050880-F7A8-436C-AD72-5E4201199421", "versionEndExcluding": "3.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento SMS Alert Order Notifications \u2013 WooCommerce para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode sa_verify del plugin en todas las versiones hasta la 3.8.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada.\n"}], "id": "CVE-2025-3878", "lastModified": "2026-06-17T09:20:50.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3878", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-12T11:53:24.225783Z", "version": "2.0.3"}}]}, "published": "2025-05-10T12:15:36.323", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/helper/shortcode.php#L103"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3290478/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a85461b7-6d16-435c-a149-ad25419a1585?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:51:54.512353+00:00", "value": {"mitigation_remediation": ["Upgrade the SMS Alert plugin to a version that sanitizes the sa_verify shortcode attributes (e.g., 3.8.2 or later).", "If an immediate upgrade is not possible, temporarily remove or disable the sa_verify shortcode for contributor\u2011level users or from all content pages. ", "Revoke contributor or higher roles from untrusted users or replace the role with a custom role that does not have access to the shortcode, ensuring that only trusted administrators can use it."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All WordPress sites running cozyvision\u2019s SMS Alert \u2013 SMS & OTP for WooCommerce plugin version 3.8.1 or earlier are affected. The vulnerability targets the plugin\u2019s shortcode handling logic and applies to any page where the sa_verify shortcode is used.", "description_and_impact": "The SMS Alert \u2013 SMS & OTP for WooCommerce plugin is vulnerable to stored Cross\u2011Site Scripting because the attributes supplied to the sa_verify shortcode are not sanitized or escaped. An authenticated user with contributor or higher privilege can inject arbitrary script code through those attributes, and the script will be stored and served whenever the page containing the shortcode is accessed.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1% and absence from CISA\u2019s KEV catalog suggest low current exploitation likelihood. However, the flaw is easy to exploit by any user with contributor-level permissions, allowing the attacker to inject and execute scripts in the context of site visitors, potentially compromising credentials, defacing content, or redirecting traffic."}}}}, "created": "2026-04-20T23:00:14.146875+00:00", "updated": "2026-04-20T23:00:14.146886+00:00", "vendors": []}