CVE-2025-1303

MEDIUMNuclei

Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-1303 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Plugin Oficial

Default status: affected

CVE ListThrough 1.7.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMPlugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting

The Plugin Oficial – Getnet para WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on the 'page' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.

Remediation

Update to the latest version beyond 1.7.3.

AuthorsShivam Kamboj
Template tagscvecve2025wordpresswpwp-pluginwc-checkout-getnetxssreflectedunauth
https://nvd.nist.gov/vuln/detail/CVE-2025-1303

Source: ProjectDiscovery

References

2