6.4 Medium

CVE-2024-13559 The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…

Description

The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product	Affected versions	Fixed in
TemplatesNext ToolKit 3.2	earliest → 3.2.9	No fix stated

The 2 CVEs of TemplatesNext ToolKit →

CVE-2025-22310 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marsian… 6.5 Medium

Do you use TemplatesNext ToolKit?

Track this CVE Watch TemplatesNext ToolKit Check my SBOMs

www.cveye.io/en/cve/CVE-2024-13559

Timeline

Published March 1, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE

CVE-2024-13559 The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…

Description

Affected products and versions

Other CVEs of TemplatesNext ToolKit