CVE-2025-9115 — Etsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI']

CVE-2025-9115

Etsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI'] PUBLISHED

Description (CNA)

The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

Affected (CNA)

Vendor / product	Versions
Unknown / Etsy Shop	affected 0 before 3.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.