PT-2026-1052 · WordPress · Shopbuilder Wordpress Plugin

Gregory Allegoet · Publicado 2026-01-02 · Atualizado 2026-01-02 · CVE-2025-13456

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ShopBuilder WordPress plugin versions prior to 3.2.2

Description The ShopBuilder WordPress plugin does not properly sanitize and escape a parameter before outputting it, resulting in a Reflected Cross-Site Scripting issue. This could potentially be used to target users with high privileges, such as administrators.

Recommendations Update to ShopBuilder WordPress plugin version 3.2.2 or later.

Exploit

Correção

Identificadores relacionados

CVE-2025-13456

Produtos afetados

Shopbuilder Wordpress Plugin

Referências · 6

• 🔥 https://wpscan.com/vulnerability/5872ece6-52cb-4306-b7ee-41282815a243 · Exploit
• https://t.me/cveNotify/147480 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2006975485465501729 · Publicação no Twitter
• https://t.me/CVEtracker/41218 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-13456 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2006988588244742223 · Publicação no Twitter