PT-2025-38689 · WordPress · Etsy Shop

Bob Matyas · CVE-2025-9115 · Published 2025-09-22 · Updated 2025-09-22

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Etsy Shop WordPress plugin versions prior to 3.0.7

Description The plugin does not properly sanitize the $ SERVER['REQUEST URI'] parameter before using it in an attribute, potentially allowing for Reflected Cross-Site Scripting in older web browsers. The $ SERVER['REQUEST URI'] parameter is used without escaping, which could allow an attacker to inject malicious scripts.

Recommendations Update to Etsy Shop WordPress plugin version 3.0.7 or later.

Exploit

Fix

Related Identifiers

CVE-2025-9115

Affected Products

Etsy Shop

References · 3

• 🔥 https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9115 · Security Note
• https://t.me/CVEtracker/33039 · Telegram Post