PT-2025-52574 · Unknown+2 · Woocommerce+2

Djaidja Moundjid · Published 2025-12-21 · Updated 2025-12-21 · CVE-2025-14054

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WC Builder – WooCommerce Page Builder for WPBakery plugin versions prior to 1.2.1

Description The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress contains a Stored Cross-Site Scripting issue. Insufficient input sanitization and output escaping in the wpbforwpbakery product additional information shortcode allows authenticated attackers, with Shop Manager-level access or higher, to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page. The vulnerability is present due to the lack of proper handling of the heading color parameter, as well as multiple other styling parameters.

Recommendations Update WC Builder – WooCommerce Page Builder for WPBakery plugin to version 1.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14054

Affected Products

Wc Builder – Woocommerce Page Builder For Wpbakery

Wpbakery

Woocommerce

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14054 · Security Note
• https://plugins.trac.wordpress.org/browser/wc-builder/tags/1.2.0/includes/addons/product_additional_information.php#L33 · Note
• https://twitter.com/CVEnew/status/2002835934195154993 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002591686761841134 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4e4fe4b6-cc1e-40be-bd2e-bf2745244892?source=cve · Note
• https://t.me/CVEtracker/40357 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wc-builder/trunk/includes/addons/product_additional_information.php#L33 · Note
• https://plugins.trac.wordpress.org/changeset/3419217 · Note
• https://t.me/cveNotify/146458 · Telegram Post