Cross-Site Scripting Vulnerability in Ni WooCommerce Sales Report Email Plugin
CVE-2025-23481

7.1HIGH

Key Information:

Vendor
WordPress
Status
Ni WooCommerce Sales Report Email
Vendor
CVE Published:
3 March 2025

Summary

A Cross-Site Scripting (XSS) vulnerability has been identified in the Ni WooCommerce Sales Report Email plugin, which allows attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects versions from n/a through 3.1.4 and can lead to unauthorized data exposure and potential exploitation by attackers through reflected XSS methods.

Affected Version(s)

Ni WooCommerce Sales Report Email <= 3.1.4

References

https://patchstack.com/database/wordpress/plugin/ni-wooco...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.