CVE-2025-60158

MediumCVSS 5.9

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Stored Cross-Site Scripting (XSS) vulnerability in Nota Fiscal Eletrônica WooCommerce (versions up to 3.4.0.9) due to improper input neutralization during web page generation.

Risk Assessment

Attackers can inject malicious scripts that execute in the user's browser, potentially leading to data theft or session hijacking.

Recommendation

Update Nota Fiscal Eletrônica WooCommerce to a patched version.

Other vulnerabilities in Nota Fiscal Eletrônica WooCommerce

CVE-2025-60159Medium
The Nota Fiscal Eletrônica WooCommerce plugin up to version 3.4.0.9 has missing authorization, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Stored XSS.This issue affects Nota Fiscal Eletrônica WooCommerce: from n/a through <= 3.4.0.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS