CVE-2025-8617

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8617", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-05T20:10:29.300Z", "datePublished": "2025-12-13T04:31:28.939Z", "dateUpdated": "2026-04-08T17:06:09.943Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:09.943Z"}, "affected": [{"vendor": "yithemes", "product": "YITH WooCommerce Quick View", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yith-woocommerce-quick-view/trunk/includes/class.yith-wcqv-frontend.php#L216"}, {"url": "https://wordpress.org/plugins/yith-woocommerce-quick-view"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-12-12T15:32:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:43:20.726881Z", "id": "CVE-2025-8617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:47:33.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:43:20.726881Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:43:21.786Z"}}], "cna": {"title": "YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "yithemes", "product": "YITH WooCommerce Quick View", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T15:32:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yith-woocommerce-quick-view/trunk/includes/class.yith-wcqv-frontend.php#L216"}, {"url": "https://wordpress.org/plugins/yith-woocommerce-quick-view"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:09.943Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8617", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:09.943Z", "dateReserved": "2025-08-05T20:10:29.300Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:28.939Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "YITH WooCommerce Quick View", "vendor": "yithemes", "versions": [{"lessThanOrEqual": "2.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin YITH WooCommerce Quick View para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode yith_quick_view del plugin en todas las versiones hasta la 2.7.0, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-8617", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8617", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:43:20.726881Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:56.130", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yith-woocommerce-quick-view/trunk/includes/class.yith-wcqv-frontend.php#L216"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3353775%40yith-woocommerce-quick-view&new=3353775%40yith-woocommerce-quick-view&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/yith-woocommerce-quick-view"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:11:19.484006+00:00", "value": {"mitigation_remediation": ["Update the YITH WooCommerce Quick View plugin to the newest release (the issue is fixed in versions after 2.7.0).", "If an update is not immediately feasible, disable the plugin or remove the yith_quick_view shortcode from all pages to prevent script injection.", "Audit the site for any injected scripts and delete any suspicious code; restrict contributor access to users who absolutely need it."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (contributor+)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the YITH WooCommerce Quick View plugin up to and including version 2.7.0. Administrators of WordPress sites that have installed this plugin should verify the installed version and determine whether a newer release is available.", "description_and_impact": "The YITH WooCommerce Quick View WordPress plugin contains a stored cross\u2011site scripting flaw that allows an attacker with contributor or higher privileges to inject arbitrary JavaScript through attributes of the yith_quick_view shortcode. Once injected, the script executes for any user who views the affected page, potentially enabling script\u2011based attacks such as session hijacking, defacement, or malicious navigation. This weakness is identified as CWE\u201179 and arises from insufficient input sanitization and output escaping during processing of the shortcode attributes.", "risk_and_exploitability": "With a CVSS score of 6.4 the flaw represents a moderate severity vulnerability and an EPSS score of less than 1% indicates that exploitation is expected to be rare. The attacker must already be authenticated at a contributor level or higher, and the attack likely originates from the plugin\u2019s front\u2011end or administration interfaces where the shortcode can be inserted. The vulnerability is not listed in the CISA KEV catalog but the potential impact of cross\u2011site script execution warrants timely remediation."}}}}, "created": "2025-12-14T21:14:50.180844+00:00", "updated": "2026-04-21T17:15:25.337456+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "yithemes", "yithemes$PRODUCT$yith_woocommerce_quick_view"]}