Stored Cross-Site Scripting Vulnerability in Simple Excel Pricelist for WooCommerce by WordPress

CVE-2025-12096

What is CVE-2025-12096?

The Simple Excel Pricelist for WooCommerce plugin suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output escaping on user-supplied attributes through the 'pricelist' shortcode. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts into web pages, which are executed when other users load the affected pages.

References