Reflected Cross-Site Scripting Vulnerability in WP Shopify Plugin
CVE-2025-7808
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 August 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-7808?
The WP Shopify plugin for WordPress prior to version 1.5.4 contains a vulnerability that allows reflected cross-site scripting (XSS). This issue arises from the failure to properly sanitize and escape a parameter before rendering it on the webpage. As a result, attackers could exploit this vulnerability, particularly targeting users with elevated privileges, such as administrators. Successful exploitation may allow an attacker to execute malicious scripts in the context of a victim's browser session.
Affected Version(s)
WP Shopify 0 < 1.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.