CVE-2025-9367

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9367", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-22T18:29:12.600Z", "datePublished": "2025-09-10T06:38:47.869Z", "dateUpdated": "2026-04-08T17:03:59.729Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:59.729Z"}, "affected": [{"vendor": "uscnanbu", "product": "Welcart e-Commerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/829facc1-443d-481f-b23f-7a93938dd866?source=cve"}, {"url": "https://wordpress.org/plugins/usc-e-shop/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3357586/usc-e-shop/trunk/classes/usceshop.class.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Miguel Santareno"}], "timeline": [{"time": "2025-08-25T01:44:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-09T18:30:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T20:28:55.635506Z", "id": "CVE-2025-9367", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:29:07.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T20:28:55.635506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:29:01.299Z"}}], "cna": {"title": "Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Miguel Santareno"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "uscnanbu", "product": "Welcart e-Commerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.11.20"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-25T01:44:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-09T18:30:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/829facc1-443d-481f-b23f-7a93938dd866?source=cve"}, {"url": "https://wordpress.org/plugins/usc-e-shop/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3357586/usc-e-shop/trunk/classes/usceshop.class.php"}], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:59.729Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9367", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:59.729Z", "dateReserved": "2025-08-22T18:29:12.600Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:47.869Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Welcart e-Commerce", "vendor": "uscnanbu", "versions": [{"lessThanOrEqual": "2.11.20", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "id": "CVE-2025-9367", "lastModified": "2026-06-17T10:08:49.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9367", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T20:28:55.635506Z", "version": "2.0.3"}}]}, "published": "2025-09-10T07:15:46.053", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3357586/usc-e-shop/trunk/classes/usceshop.class.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/usc-e-shop/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/829facc1-443d-481f-b23f-7a93938dd866?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:09:35.553240+00:00", "value": {"mitigation_remediation": ["Update the Welcart e\u2011Commerce plugin to the latest version (2.11.21 or newer) which removes the stored XSS flaw.", "Verify that the unfiltered_html capability is disabled for all but trusted administrators and that editors do not have this capability.", "Audit the plugin settings for any malicious scripts and remove suspicious entries to eliminate existing stored XSS payloads."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affected systems are multi\u2011site WordPress installations running any Welcart e\u2011Commerce version 2.11.20 or earlier where the unfiltered_html feature has been disabled. Only administrators or editors with write access to the plugin\u2019s settings can exploit the flaw.", "description_and_impact": "The vulnerability exists in Welcart e\u2011Commerce up to version 2.11.20 and allows an authenticated user with editor or higher privileges to store malicious JavaScript in the plugin\u2019s settings. When certain pages are rendered, the stored script is executed in the browsers of any user who views those pages, potentially enabling session hijacking, data theft, or defacement. The weakness arises from insufficient sanitization of user input and inadequate output escaping, a classic input validation flaw identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 5.5 denotes a medium severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation in the wild today. Since the vulnerability requires authenticated access and the affected environment must have unfiltered_html turned off, the attack surface is narrower, though the impact on users who view the compromised pages is still significant. The vulnerability is not currently listed in CISA\u2019s KEV catalog."}}}}, "created": "2025-09-12T09:11:34.004461+00:00", "updated": "2026-04-21T19:15:26.037465+00:00", "vendors": ["welcart", "welcart$PRODUCT$e-commerce", "welcart$PRODUCT$welcart_e-commerce", "wordpress", "wordpress$PRODUCT$wordpress"]}