Threat Entry Updated 2025-09-22

CVE-2025-9115 - Etsy Shop Plugin

The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

PLUGIN Etsy Shop

CVE-2025-9115

MEDIUM CVSS 5.6 2025-09-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-5470 - Etsy Shop Plugin

The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Etsy Shop

CVE-2023-5470

MEDIUM CVSS 6.4 2023-10-12

Risk Score

Open Full Technical Breakdown