{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-25152/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-25152/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-25152/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-25152/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-25152/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-25152"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-25152"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-25152.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2019-25152\n\ninfo:\n  name: Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.\n  impact: |\n    This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.\n  remediation: Fixed in 5.2.0\n  reference:\n    - https://wpscan.com/vulnerability/915420b1-f476-481e-9b11-b736a7cfdda7/\n    - https://wpscan.com/vulnerability/9229\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-25152\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2019-25152\n    epss-score: 0.01353\n    epss-percentile: 0.71665\n    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: tychesoftwares\n    product: abandoned_cart_lite_for_woocommerce\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/woocommerce-abandoned-cart/\"\n    shodan-query: http.html:\"/wp-content/plugins/woocommerce-abandoned-cart/\"\n  tags: cve,cve2019,wpscan,wordpress,wp,wp-plugin,woocommerce-abandoned-cart,xss,passive,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/woocommerce-abandoned-cart/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"< 5.2.0\")'\n          - 'contains(body, \"Abandoned Cart\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - \"(?mi)Stable tag: ([0-9.]+)\"\n        internal: true\n# digest: 490a00463044022054fd3a78816a062ec33fc5733ed6a883d8bded233bdb420de6bfa213e63102ce02203fe620b778485a94cc799ea322765c0e34cb901e333957b470d37822b4521b07:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-25152"
}