PT-2025-47974 · Unknown+1 · Woocommerce+1

Published 2025-11-24 · Updated 2025-11-25 · CVE-2025-10144

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Perfect Brands for WooCommerce plugin for WordPress versions through 3.6.2

Description The Perfect Brands for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection through the brands attribute of the products shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries contribute to this issue. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update The Perfect Brands for WooCommerce plugin to a version later than 3.6.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10144

Affected Products

Perfect Brands For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10144 · Security Note
• https://t.me/cveNotify/143885 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993120279980081519 · Twitter Post
• https://plugins.trac.wordpress.org/browser/perfect-woocommerce-brands/tags/3.6.0/lib/class-woocommerce.php#L112 · Note
• https://twitter.com/CVEnew/status/1993091802405257551 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f4618bfd-77d9-4396-b041-d7ba0f6ec75a?source=cve · Note
• https://t.me/CVEtracker/38132 · Telegram Post