CVE-2025-32523 - Vulnerability Details

Link	Providers
https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS. This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0.
Title		WordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-32523", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-04-09T11:19:35.669Z", "datePublished": "2025-04-11T08:42:52.766Z", "dateUpdated": "2025-04-11T13:52:58.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-04-11T08:42:52.766Z"}, "title": "WordPress WooCommerce \u2013 Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "payphone", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wc-payphone-gateway", "product": "WooCommerce \u2013 Payphone Gateway", "versions": [{"lessThanOrEqual": "3.2.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce \u2013 Payphone Gateway allows Reflected XSS. This issue affects WooCommerce \u2013 Payphone Gateway: from n/a through 3.2.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce \u2013 Payphone Gateway allows Reflected XSS.</p><p>This issue affects WooCommerce \u2013 Payphone Gateway: from n/a through 3.2.0.</p>"}]}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseSeverity": "HIGH", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "version": "3.1"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) (Patchstack Alliance)"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-11T13:30:48.359125Z", "id": "CVE-2025-32523", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:52:58.053Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-32523 (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

state : PUBLISHED (string)

assignerShortName : Patchstack (string)

dateReserved : 2025-04-09T11:19:35.669Z (string)

datePublished : 2025-04-11T08:42:52.766Z (string)

dateUpdated : 2025-04-11T13:52:58.053Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-04-11T08:42:52.766Z (string)

}

title : WordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

impacts : [ »

0 : { »

capecId : CAPEC-591 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-591 Reflected XSS (string)

}

]

}

]

affected : [ »

0 : { »

vendor : payphone (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

packageName : wc-payphone-gateway (string)

product : WooCommerce – Payphone Gateway (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.2.0 (string)

status : affected (string)

version : n/a (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS. This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

base64 : false (boolean)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0. (string)

}

]

}

]

references : [ »

0 : { »

tags : [ »

0 : vdb-entry (string)

]

url : https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

baseScore : 7.1 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

baseSeverity : HIGH (string)

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

version : 3.1 (string)

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : João Pedro S Alcântara (Kinorth) (Patchstack Alliance) (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-11T13:30:48.359125Z (string)

id : CVE-2025-32523 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-11T13:52:58.053Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-32523", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-11T13:30:48.359125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:45:06.780Z"}}], "cna": {"title": "WordPress WooCommerce \u2013 Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "payphone", "product": "WooCommerce \u2013 Payphone Gateway", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.2.0"}], "packageName": "wc-payphone-gateway", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce \u2013 Payphone Gateway allows Reflected XSS. This issue affects WooCommerce \u2013 Payphone Gateway: from n/a through 3.2.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce \u2013 Payphone Gateway allows Reflected XSS.</p><p>This issue affects WooCommerce \u2013 Payphone Gateway: from n/a through 3.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-04-11T08:42:52.766Z"}}}, "cveMetadata": {"cveId": "CVE-2025-32523", "state": "PUBLISHED", "dateUpdated": "2025-04-11T13:52:58.053Z", "dateReserved": "2025-04-09T11:19:35.669Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-04-11T08:42:52.766Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-32523 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-11T13:30:48.359125Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-11T13:45:06.780Z (string)

}

]

cna : { »

title : WordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : João Pedro S Alcântara (Kinorth) (Patchstack Alliance) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-591 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-591 Reflected XSS (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 7.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : payphone (string)

product : WooCommerce – Payphone Gateway (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

versionType : custom (string)

lessThanOrEqual : 3.2.0 (string)

}

]

packageName : wc-payphone-gateway (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

tags : [ »

0 : vdb-entry (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS. This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-04-11T08:42:52.766Z (string)

}

cveMetadata : { »

cveId : CVE-2025-32523 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-11T13:52:58.053Z (string)

dateReserved : 2025-04-09T11:19:35.669Z (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

datePublished : 2025-04-11T08:42:52.766Z (string)

assignerShortName : Patchstack (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce \u2013 Payphone Gateway allows Reflected XSS. This issue affects WooCommerce \u2013 Payphone Gateway: from n/a through 3.2.0."}, {"lang": "es", "value": " Vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('Cross-site Scripting') en payphone WooCommerce \u2013 Payphone Gateway permite XSS reflejado. Este problema afecta a WooCommerce \u2013 Payphone Gateway: desde n/d hasta 3.2.0."}], "id": "CVE-2025-32523", "lastModified": "2025-04-11T15:39:52.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-04-11T09:15:24.313", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway allows Reflected XSS. This issue affects WooCommerce – Payphone Gateway: from n/a through 3.2.0. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en payphone WooCommerce – Payphone Gateway permite XSS reflejado. Este problema afecta a WooCommerce – Payphone Gateway: desde n/d hasta 3.2.0. (string)

}

]

id : CVE-2025-32523 (string)

lastModified : 2025-04-11T15:39:52.920 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.7 (number)

source : audit@patchstack.com (string)

type : Secondary (string)

}

]

}

published : 2025-04-11T09:15:24.313 (string)

references : [ »

0 : { »

source : audit@patchstack.com (string)

url : https://patchstack.com/database/wordpress/plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

}

]

sourceIdentifier : audit@patchstack.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : audit@patchstack.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object