CVE-2025-5530

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5530", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-03T14:41:48.604Z", "datePublished": "2025-07-11T07:23:00.319Z", "dateUpdated": "2026-04-08T16:47:18.811Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:18.811Z"}, "affected": [{"vendor": "wpclever", "product": "WPC Smart Compare for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd09891-8117-43b1-8744-8f3773971540?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L187"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L2616"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-10T18:58:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-11T16:52:40.326443Z", "id": "CVE-2025-5530", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T16:52:48.519Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5530", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-11T16:52:40.326443Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T16:52:44.540Z"}}], "cna": {"title": "WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpclever", "product": "WPC Smart Compare for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-10T18:58:43.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd09891-8117-43b1-8744-8f3773971540?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L187"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L2616"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:18.811Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5530", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:18.811Z", "dateReserved": "2025-06-03T14:41:48.604Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-11T07:23:00.319Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPC Smart Compare for WooCommerce", "vendor": "wpclever", "versions": [{"lessThanOrEqual": "6.4.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpclever:wpc_smart_compare_for_woocommerce:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "376714E0-8F5D-4905-B1EE-1281AC43608A", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WPC Smart Compare para WooCommerce de WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'shortcode_btn' en todas las versiones hasta la 6.4.6 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5530", "lastModified": "2026-06-17T09:48:06.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5530", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-11T16:52:40.326443Z", "version": "2.0.3"}}]}, "published": "2025-07-11T08:15:24.123", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L187"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L2616"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd09891-8117-43b1-8744-8f3773971540?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:45:28.045096+00:00", "value": {"mitigation_remediation": ["Update WPC Smart Compare for WooCommerce to the latest version (at least 6.4.7) to remove the vulnerable shortcode implementation.", "If a patch cannot be applied immediately, limit the use of the shortcode_btn to administrators only or disable the shortcode altogether on publicly accessible pages.", "Implement a content filtering or security plugin that blocks or sanitizes potentially malicious scripts before they are rendered in the browser."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the wpclever WPC Smart Compare for WooCommerce plugin installed with a version up to and including 6.4.6 are affected. The plugin provides a \"shortcode_btn\" feature that is used by site administrators and contributors to add comparison buttons. Any site using these versions is therefore vulnerable.", "description_and_impact": "A stored cross\u2011site scripting vulnerability exists in the shortcode_btn shortcode of the WPC Smart Compare for WooCommerce plugin. Insufficient input sanitization and output escaping allow an attacker with authenticated contributor\u2011level access to inject arbitrary JavaScript that is stored and served on any page containing the shortcode. This can lead to defacement, credential theft, session hijacking, or other malicious actions performed in the context of users who visit the affected pages.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity level. The EPSS score of less than 1% suggests that the likelihood of real\u2011world exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with contributor or higher privileges to place or modify content containing the vulnerable shortcode, after which the malicious payload is stored in the database and served when any user views the affected page."}}}}, "created": "2026-04-21T20:00:25.883361+00:00", "updated": "2026-04-21T20:00:25.883395+00:00", "vendors": []}