PT-2025-43053 · WordPress · Simple Business Data

Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-11870

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Business Data plugin for WordPress versions up to and including 1.0.1

Description The Simple Business Data plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'simple business data' shortcode attributes. The issue arises from insufficient sanitization of user input and inadequate output escaping when the type attribute is embedded into the class attribute within rendered HTML. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute each time a user accesses the compromised page.

Recommendations Update the Simple Business Data plugin to a version beyond 1.0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11870

Affected Products

Simple Business Data

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11870 · Security Note
• https://t.me/CVEtracker/35474 · Telegram Post
• https://plugins.trac.wordpress.org/browser/simple-business-data/tags/1.0.1/templates/simple-business-data-template.php#L14 · Note
• https://t.me/cveNotify/139828 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bd2754f9-11f7-4690-99dd-2204e69bf14b?source=cve · Note