CVE-2025-8618

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8618", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-05T20:13:47.043Z", "datePublished": "2025-08-20T04:26:20.467Z", "dateUpdated": "2026-04-08T16:59:28.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:28.842Z"}, "affected": [{"vendor": "wpclever", "product": "WPC Smart Quick View for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8b2ec1-a76b-42df-8540-4aecaa35efd3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/trunk/wpc-smart-quick-view.php#L545"}, {"url": "https://wordpress.org/plugins/woo-smart-quick-view"}, {"url": "https://plugins.trac.wordpress.org/changeset/3346074/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-08-16T11:11:26.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-19T16:23:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-20T15:56:04.863540Z", "id": "CVE-2025-8618", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T15:56:37.092Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8618", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-20T15:56:04.863540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T15:56:19.681Z"}}], "cna": {"title": "WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpclever", "product": "WPC Smart Quick View for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-16T11:11:26.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-19T16:23:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8b2ec1-a76b-42df-8540-4aecaa35efd3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/trunk/wpc-smart-quick-view.php#L545"}, {"url": "https://wordpress.org/plugins/woo-smart-quick-view"}, {"url": "https://plugins.trac.wordpress.org/changeset/3346074/"}], "descriptions": [{"lang": "en", "value": "The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:28.842Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8618", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:28.842Z", "dateReserved": "2025-08-05T20:13:47.043Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-20T04:26:20.467Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPC Smart Quick View for WooCommerce", "vendor": "wpclever", "versions": [{"lessThanOrEqual": "4.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WPC Smart Quick View for WooCommerce de WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del shortcode woosq_btn del complemento en todas las versiones hasta la 4.2.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-8618", "lastModified": "2026-06-17T10:07:19.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8618", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-20T15:56:04.863540Z", "version": "2.0.3"}}]}, "published": "2025-08-20T05:15:28.443", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/trunk/wpc-smart-quick-view.php#L545"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3346074/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/woo-smart-quick-view"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8b2ec1-a76b-42df-8540-4aecaa35efd3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:54:55.803077+00:00", "value": {"mitigation_remediation": ["Upgrade the WPC Smart Quick View for WooCommerce plugin to version 4.2.2 or later", "Restrict or remove contributor\u2011level permissions from users and disable the use of woosq_btn shortcode for those roles", "Implement a web\u2011application firewall rule that blocks non\u2011alphanumeric characters in the woosq_btn shortcode attributes or sanitizes supplied input before rendering"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the wpclever WPC Smart Quick View for WooCommerce plugin in all releases up to and including version 4.2.1. Any WordPress installation that has the plugin installed at or below v4.2.1 is susceptible.", "description_and_impact": "The WPC Smart Quick View for WooCommerce plugin contains insufficient input sanitization and output escaping on attributes supplied to the woosq_btn shortcode (CWE\u201179). This flaw allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript into WordPress pages. When a victim visits a page containing the malicious shortcode, the injected script is executed within the victim\u2019s browser context.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests low exploitation likelihood. The vulnerability is not listed in CISA KEV, implying it is not a widely known or publicly exploited exploit. Attackers must first authenticate as a contributor or higher role in the WordPress site and then use the woosq_btn shortcode to embed malicious scripts. The impact is limited to pages rendered after the injection; broader network compromise is not inherent to the flaw."}}}}, "created": "2025-08-21T12:31:29.780395+00:00", "updated": "2026-04-22T01:00:04.364017+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpclever", "wpclever$PRODUCT$wpc_smart_quick_view_for_woocommerce"]}