CVE-2025-14436

Name of the Vulnerable Software and Affected Versions Brevo for WooCommerce versions up to and including 4.0.49

Description The Brevo for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the user connection id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update Brevo for WooCommerce to a version later than 4.0.49.