CVE-2025-9207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9207", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-19T18:35:49.896Z", "datePublished": "2025-12-13T07:21:04.397Z", "dateUpdated": "2026-04-08T17:06:08.508Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:08.508Z"}, "affected": [{"vendor": "templateinvaders", "product": "TI WooCommerce Wishlist", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items."}], "title": "TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L326"}, {"url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L544"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399224%40ti-woocommerce-wishlist&new=3399224%40ti-woocommerce-wishlist&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Pim Schaaf"}], "timeline": [{"time": "2025-05-13T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-12T19:15:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:24:49.847175Z", "id": "CVE-2025-9207", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:32:52.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:24:49.847175Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:24:50.897Z"}}], "cna": {"title": "TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection", "credits": [{"lang": "en", "type": "finder", "value": "Pim Schaaf"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "templateinvaders", "product": "TI WooCommerce Wishlist", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.10.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-13T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-12T19:15:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L326"}, {"url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L544"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399224%40ti-woocommerce-wishlist&new=3399224%40ti-woocommerce-wishlist&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:08.508Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9207", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:08.508Z", "dateReserved": "2025-08-19T18:35:49.896Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T07:21:04.397Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TI WooCommerce Wishlist", "vendor": "templateinvaders", "versions": [{"lessThanOrEqual": "2.10.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items."}, {"lang": "es", "value": "El plugin TI WooCommerce Wishlist para WordPress es vulnerable a la inyecci\u00f3n HTML en todas las versiones hasta la 2.10.0, inclusive. Esto se debe a que el plugin acepta campos ocultos y no limita los valores o datos que se pueden introducir y que posteriormente se muestran. Esto hace posible que atacantes no autenticados inyecten HTML arbitrario en los elementos de la lista de deseos."}], "id": "CVE-2025-9207", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9207", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:24:49.847175Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:56.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L326"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L544"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399224%40ti-woocommerce-wishlist&new=3399224%40ti-woocommerce-wishlist&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:46:27.536644+00:00", "value": {"mitigation_remediation": ["Upgrade the TI WooCommerce Wishlist plugin to a version newer than 2.10.0 to remove the unauthenticated HTML injection flaw.", "If a timely upgrade is not possible, configure the plugin or surrounding code to validate and sanitize all hidden fields and block untrusted HTML before rendering the wishlist page.", "Deploy a Web Application Firewall or a dedicated security plugin that filters out disallowed HTML elements from user\u2011supplied content on WordPress sites."], "summary": {"action": "Patch", "impact": "Unauthorized HTML injection leading to cross\u2011site scripting"}, "threat_synthesis": {"affected_systems": "The issue affects the TemplateInvaders TI WooCommerce Wishlist plugin for WordPress, versions 2.10.0 and earlier. Users deploying these editions on any WordPress installation are at risk. No other products are mentioned.", "description_and_impact": "The TI WooCommerce Wishlist plugin for WordPress contains an input\u2011validation flaw that allows attackers to inject arbitrary HTML into wishlist items. The plugin accepts hidden fields without restricting their content or performing proper filtering before output. This flaw does not require authentication; any user who can submit data to the wishlist can craft malicious payloads. The vulnerability can lead to client\u2011side code execution, credential theft, or defacement, impacting confidentiality, integrity and availability of the site\u2019s front end.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a low exploitation probability in the current threat landscape, and the vulnerability is not listed in CISA\u2019s KEV catalog. Because the attack can be launched without authentication, an adversary could target any public site using the affected plugin. However, successful exploitation requires the injection of attacker\u2011controlled HTML into a visible page, which may be constrained by site\u2011level restrictions or client\u2011side filtering. The primary risk is cross\u2011site scripting rather than remote code execution."}}}}, "created": "2025-12-14T21:14:30.674228+00:00", "updated": "2026-04-21T01:00:12.925933+00:00", "vendors": ["templateinvaders", "templateinvaders$PRODUCT$ti_woocommerce_wishlist", "wordpress", "wordpress$PRODUCT$wordpress"]}