CVE-2025-9115 - Etsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI']

Back Back to CVE browser

MEDIUM

Etsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI']

Published Sep 22, 2025

5.6

MEDIUM

CVSS 3.1

EPSS 0.20%

Description

The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

Affected products

Vendor n/a Product Etsy Shop Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.0.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Etsy Shop

unaffected

Version	Status	Constraints
0	affected	<3.0.7

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 22, 2025

Updated Sep 22, 2025

Reserved Aug 18, 2025

Link CVE-2025-9115

CISA Vulnrichment

Updated Sep 22, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-9115

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-9115