CVE-2025-2169— WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-2169
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
Source: CVE Program / CVE List V5
Vulnerability Description
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin WPCS 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WPCS 1.2.0.4及之前版本存在代码注入漏洞，该漏洞源于未验证值就执行短代码，可能导致任意短代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| realmag777 | WPCS – WordPress Currency Switcher Professional | * ~ 1.2.0.4 | - |
II. Public POCs for CVE-2025-2169
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-2169
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-2169 (3)
Vendor Advisories for CVE-2025-2169 (1)
IV. Related Vulnerabilities
Same product: WPCS – WordPress Currency Switcher Professional
- CVE-2023-51506
WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site S - CVE-2023-2555
WPCS – WordPress Currency Switcher Professional <= 1.1.9 - M - CVE-2023-2557
WPCS – WordPress Currency Switcher Professional <= 1.1.9 - M - CVE-2023-2558
WPCS – WordPress Currency Switcher Professional <= 1.1.9 - A - CVE-2023-2556
WPCS – WordPress Currency Switcher Professional <= 1.1.9 - M
Same vendor: realmag777
- CVE-2026-57409
WordPress Active Products Tables for WooCommerce plugin <= 1 - CVE-2026-57320
WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) - CVE-2026-57319
WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) v - CVE-2026-39574
WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection v - CVE-2026-9241
FOX – Currency Switcher Professional for WooCommerce <= 1.4.
Same weakness: CWE-94
- CVE-2026-65804
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-18667
Sensor Proxy Version 1.4.2 Fixes One Vulnerability - CVE-2026-61523
WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Edito - CVE-2026-69088
Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation vi - CVE-2026-67340
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scr
V. Comments for CVE-2025-2169
No comments yet