Stored Cross-Site Scripting Vulnerability in Brevo for WooCommerce Plugin

CVE-2025-14436

What is CVE-2025-14436?

The Brevo for WooCommerce plugin for WordPress is susceptible to a stored cross-site scripting vulnerability via the 'user_connection_id' parameter. This issue arises from inadequate input sanitization and output escaping techniques implemented in all versions prior to and including 4.0.49. Consequently, unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into web pages that will execute whenever a user accesses the affected pages, posing a significant risk to users and website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References