CVE-2025-9115

Name of the Vulnerable Software and Affected Versions Etsy Shop WordPress plugin versions prior to 3.0.7

Description The plugin does not properly sanitize the $ SERVER['REQUEST URI'] parameter before using it in an attribute, potentially allowing for Reflected Cross-Site Scripting in older web browsers. The $ SERVER['REQUEST URI'] parameter is used without escaping, which could allow an attacker to inject malicious scripts.

Recommendations Update to Etsy Shop WordPress plugin version 3.0.7 or later.