EUVD-2025-32530Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authenticated with contributor privileges, network attack, low complexity, no user interaction, scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in the Auto Bulb Finder for WordPress plugin up to version 2.8.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'abf_vehicle' shortcode. When a victim views the compromised page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit has been identified, and the EPSS score is low (0.03%), indicating limited exploitation activity at the time of analysis.
Technical ContextAI
The vulnerability resides in the WordPress shortcode 'abf_vehicle', which processes user-supplied attributes without adequate input sanitization or output escaping. This is a classic Stored XSS (CWE-79) where attacker-controlled input is stored in the database and later rendered unsanitized in the browser. The plugin is designed for automotive parts compatibility; the shortcode is likely used on product pages or vehicle-specific content. The CPE for the plugin is not explicitly listed, but the affected product is the 'Auto Bulb Finder for WordPress' from the wordpress.org plugin repository.
RemediationAI
Upgrade the Auto Bulb Finder for WordPress plugin to the patched version. The vendor has provided a fix via a Trac changeset; the latest stable release should be installed. As a workaround, limit contributor-level access to trusted users only, since the attack requires that privilege level. Additionally, a Web Application Firewall (WAF) with XSS filtering rules may provide partial protection but does not address the root cause. If upgrade is not immediately possible, disable the 'abf_vehicle' shortcode by removing or commenting out its registration in the plugin's code, though this may break functionality. Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/c141af66-ebf6-4a80-8dfd-47a586342676 and the changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3414958%40auto-bulb-finder-for-wp-wc&new=3414958%40auto-bulb-finder-for-wp-wc.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today