CVE-2025-1689

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-16905.4The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up CVE-2025-16916.5The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can CVE-2025-16928.8The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate CVE-2025-16936.8The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can in CVE-2025-16955.3In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an inc CVE-2025-16965.2A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information vi CVE-2025-16977.8A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior CVE-2025-16982.8Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial o CVE-2025-16992.8An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.CVE-2025-17007.0A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local atta CVE-2025-17018.9CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially CVE-2025-17027.5The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v