WordPress Plugin Oficial – Getnet para WooCommerce plugin < 1.8.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Plugin Oficial – Getnet para WooCommerce versions 1.8.1...

CVE-2025-1289

The Plugin Oficial – Getnet para WooCommerce WordPress plugin, in versions up to and including 1.7.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such a...

CVE-2025-1289 Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSS

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...