CVE-2025-15488
Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution
Vexday Risk Score
35Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS 6.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
26 mar 2026Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Unknown · Responsive Plus