Reflected XSS Vulnerability in URL Shortener by AB Testing
CVE-2025-23789

7.1HIGH

Key Information:

Vendor
WordPress
Status
Url Shortener | Conversion Tracking | Ab Testing | WooCommerce
Vendor
CVE Published:
14 February 2025

Summary

A reflected Cross-site Scripting (XSS) vulnerability has been identified in the URL Shortener, Conversion Tracking, and AB Testing plugin for WooCommerce. This flaw allows an attacker to inject malicious scripts into web pages viewed by users. When exploited, it can lead to unauthorized actions on behalf of the user, information theft, and other potential security breaches. Affected versions range from unspecified releases through 9.0.2, emphasizing the need for website administrators to take immediate action to mitigate risks associated with this vulnerability.

Affected Version(s)

URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2

References

https://patchstack.com/database/wordpress/plugin/easy-bro...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.