Stored Cross-Site Scripting Vulnerability in Brevo for WooCommerce Plugin
CVE-2025-14436
7.2HIGH
What is CVE-2025-14436?
The Brevo for WooCommerce plugin for WordPress is susceptible to a stored cross-site scripting vulnerability via the 'user_connection_id' parameter. This issue arises from inadequate input sanitization and output escaping techniques implemented in all versions prior to and including 4.0.49. Consequently, unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into web pages that will execute whenever a user accesses the affected pages, posing a significant risk to users and website integrity.
Affected Version(s)
Brevo for WooCommerce * <= 4.0.49
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Angus Girvan