CVE-2025-2929 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the Order Delivery Date WordPress plugin prior to version 12.4.0. This flaw allows an attacker to inject malicious scripts into a web page due to insufficient sanitization and escaping of a parameter, affecting the tychesoftwares order_delivery_date_for_woocommerce plugin. Rated with a CVSS score of 7.1 (High), this vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R). Successful exploitation could lead to limited confidentiality, integrity, and availability impacts (C:L/I:L/A:L), particularly against high-privilege users like administrators. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, indicating a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.4.0CPE matchmatch criteria | cpe:2.3:a:tychesoftwares:order_delivery_date_for_woocommerce:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.