CVE-2025-23789

WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 14, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through <= 9.0.2.

Analysis

AI-generated

Technical impact

Improper neutralization of user input during page generation enables reflected cross‑site scripting. An attacker can insert malicious scripts into URL parameters that the plugin echoes back without escaping, potentially allowing arbitrary script execution in the victim’s browser.

Affected Systems

All installations of the tahminajannat "URL Shortener | Conversion Tracking | AB Testing | WooCommerce" plugin running version 9.0.2 or earlier are affected, because the vulnerability is present through that version.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of < 1 % shows a low probability of exploitation as of now. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely need to entice a user to click a crafted link containing malicious payloads; no elevated privileges beyond a normal visitor are required for exploitation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the plugin to version 9.0.3 or later.
  • If an update cannot be performed immediately, disable or uninstall the URL Shortener plugin until a fix is applied.
  • Implement a web application firewall rule or custom input‑sanitization logic that blocks or neutralizes malicious script content in URL parameters while the plugin remains disabled.

Generated by OpenCVE AI on May 2, 2026 at 04:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3421 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through 9.0.2.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through 9.0.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through <= 9.0.2.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00032}

 epss

{'score': 0.00035}
Type Values Removed Values Added
Metrics epss

{'score': 0.00072}

 epss

{'score': 0.00032}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through 9.0.2.
Title WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 11:37 PM
Reserved
Jan 16, 2025, 11:30 AM

View source JSON

Updated
Feb 14, 2025, 3:49 PM

JSON

Status
Deferred
Published
Feb 14, 2025, 1:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 2, 2026, 4:45 AM

JSON