Stored Cross-Site Scripting Vulnerability in Ebook Store Plugin for WordPress

CVE-2025-7486

What is CVE-2025-7486?

The Ebook Store plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping in the Order Details. This vulnerability primarily affects all installations of the plugin prior to version 5.8012 and is particularly concerning in multi-site setups or when the 'unfiltered_html' capability is disabled. Authenticated attackers with administrator access can exploit this flaw, allowing them to inject arbitrary web scripts, which execute when users interact with affected pages.

References