PT-2026-1052 · WordPress · Shopbuilder Wordpress Plugin

Gregory Allegoet · Published 2026-01-02 · Updated 2026-01-02 · CVE-2025-13456

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ShopBuilder WordPress plugin versions prior to 3.2.2

Description The ShopBuilder WordPress plugin does not properly sanitize and escape a parameter before outputting it, resulting in a Reflected Cross-Site Scripting issue. This could potentially be used to target users with high privileges, such as administrators.

Recommendations Update to ShopBuilder WordPress plugin version 3.2.2 or later.

Exploit

Fix

Related Identifiers

CVE-2025-13456

Affected Products

Shopbuilder Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/5872ece6-52cb-4306-b7ee-41282815a243 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13456 · Security Note
• https://t.me/cveNotify/147480 · Telegram Post
• https://twitter.com/CVEnew/status/2006975485465501729 · Twitter Post
• https://t.me/CVEtracker/41218 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006988588244742223 · Twitter Post