The Ebook Store WordPress plugin before version 5.8015 is vulnerable to Reflected Cross-Site Scripting due to improper escaping of the $_SERVER[‘REQUEST_URI’] parameter. This vulnerability can be exploited in older web browsers, potentially allowing attackers to execute malicious scripts. Users are encouraged to update to the latest version to mitigate this risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-8113 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious URL that includes a payload in the $_SERVER[‘REQUEST_URI’] parameter. When a user visits the crafted URL in an old web browser, the script can be executed in the context of the user’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- Ebook Store WordPress Plugin: A plugin for WordPress that allows users to manage and sell ebooks, vulnerable to XSS in versions prior to 5.8015.
Mitigation
To mitigate this vulnerability, users should update the Ebook Store WordPress plugin to version 5.8015 or later, where the issue has been addressed. Additionally, implementing security best practices such as input validation and output encoding can help prevent similar vulnerabilities.