CVE-2025-15058 spwebguy CVE debrief

Who should care

Defenders responsible for WordPress installations using the Responsive Pricing Table plugin should assess exposure and prioritize verification of the plugin version. Those with Contributor-level access or higher should be particularly cautious. Security teams should monitor for suspicious activity related to the plugin's functionality.

Why it matters

CVE-2025-15058 is a Stored Cross-Site Scripting vulnerability in the Responsive Pricing Table plugin for WordPress. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity.

• Defenders must verify exposure of WordPress installations using the Responsive Pricing Table plugin.
• Inventory checks are necessary to determine if the plugin version is 5.1.12 or earlier.
• Monitoring for suspicious activity related to the plugin's functionality is recommended.
• Remediation priority follows from verifying the plugin version and ensuring it is updated beyond 5.1.12 if possible.

Technical summary

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and including, 5.1.12. The vulnerability exists due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute when a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Responsive Pricing Table plugin, especially those with Contributor-level access or higher. They should assess the plugin version and ensure it is updated beyond 5.1.12 if possible. Inventory checks and monitoring for suspicious activity related to the plugin's functionality are recommended.

Recommended defensive actions

• Verify WordPress installations for the Responsive Pricing Table plugin version 5.1.12 or earlier
• Update the plugin to a version beyond 5.1.12 if available
• Monitor for suspicious activity related to the plugin's functionality
• Restrict Contributor-level access and above to trusted users
• Perform inventory checks to determine if the plugin version is 5.1.12 or earlier
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Responsive Pricing Table plugin for WordPress. The vulnerability allows for Stored Cross-Site Scripting via the 'table_currency' parameter. Contributor-level access and above is required for exploitation. The CVE and NVD entries do not provide specific information on known affected or fixed versions beyond version 5.1.12.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.