PT-2026-28213 · WordPress · Responsive Plus

Alex Tselevich · Published 2026-03-26 · Updated 2026-03-26 · CVE-2025-15488

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Responsive Plus WordPress plugin versions prior to 3.4.3

Description The software allows unauthenticated users to execute the update responsive woo free shipping left shortcode AJAX action without proper validation of the content rech data parameter. This can lead to arbitrary shortcode execution. The vulnerable action processes the content rech data parameter as a shortcode.

Recommendations Update to version 3.4.3 or later.

Exploit

Fix

Related Identifiers

CVE-2025-15488

Affected Products

Responsive Plus

References · 3

• 🔥 https://wpscan.com/vulnerability/80ce0f88-3065-48c4-a491-b70e067ce4d7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15488 · Security Note
• https://twitter.com/CVEnew/status/2037137732741259297 · Twitter Post