The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
References
Configurations
No configuration.
History
22 Sep 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.6 |
22 Sep 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-22 06:15
Updated : 2025-09-22 21:22
NVD link : CVE-2025-9115
Mitre link : CVE-2025-9115
CVE.ORG link : CVE-2025-9115
JSON object : View
Products Affected
No product.
CWE
No CWE.