Unrated severityNVD Advisory· Published Oct 16, 2024· Updated Apr 8, 2026
ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting
CVE-2019-25214
Description
The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts.
Affected products
1- Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.