CVE-2025-7486 in Ebook Store Plugin
Summary
by MITRE • 07/22/2025
The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/13/2026
The Ebook Store plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects versions up to and including 5.8012, creating a significant security risk for affected installations. This vulnerability stems from inadequate input sanitization and insufficient output escaping mechanisms within the plugin's Order Details functionality, allowing malicious actors to inject persistent malicious scripts into the system. The flaw specifically targets the plugin's handling of user-supplied data within order management interfaces, where attacker-controlled input is not properly validated or escaped before being rendered in web pages. The vulnerability requires authenticated access with administrator-level privileges, meaning that only users with elevated permissions can exploit this weakness, but the impact remains severe given the privileged position such users hold within the WordPress environment.
The technical implementation of this vulnerability occurs within the plugin's order processing and display mechanisms, where order details containing user input are stored in the database without proper sanitization. When these stored order details are subsequently retrieved and displayed to other users, the malicious scripts are executed in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or further exploitation of the compromised WordPress installation. The vulnerability's exploitation is limited to multi-site installations and environments where the unfiltered_html capability has been disabled, which creates a specific attack surface that security administrators must consider when assessing their risk exposure. This restriction means that the vulnerability may not affect all WordPress installations equally, but those that meet these criteria face a heightened risk of successful exploitation.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a wide range of malicious activities within the compromised WordPress environment. Attackers can leverage this vulnerability to steal administrator session cookies, modify order details, manipulate customer data, or even install additional malware within the WordPress installation. The stored nature of the vulnerability means that once exploited, the malicious scripts persist and will execute whenever any user accesses the affected order details page, creating a continuous threat vector that can affect multiple users over time. This persistent threat is particularly concerning in multi-site environments where the impact can cascade across multiple individual sites within the network, potentially affecting numerous users and data sets.
Organizations should implement immediate mitigations including updating to the latest version of the Ebook Store plugin where available, as well as implementing additional security measures such as restricting administrator privileges to only necessary users and monitoring for unusual activity in order management sections. The vulnerability aligns with CWE-79 which describes Cross-Site Scripting flaws, and represents a specific implementation weakness that could be categorized under ATT&CK technique T1566 for malicious code injection. Security teams should also consider implementing web application firewalls to detect and block suspicious input patterns, as well as conducting thorough audits of all plugin installations to identify similar vulnerabilities in other third-party components. Regular security assessments and penetration testing should be performed to identify potential exploitation vectors, while user access controls should be strictly enforced to minimize the risk of privilege escalation attacks that could lead to exploitation of this vulnerability.