CVE-2025-12358
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. Missing nonce validation on the "post_add_to_list" function and an incorrect permissions callback in the "Api/init" function allow an unauthenticated attacker to add or remove products from a user's wishlist via a forged request if they trick a site user into clicking a link.
Risk Assessment
An attacker can modify users' wishlists, potentially leading to unwanted changes to their accounts and reduced trust in the store.
Recommendation
Update the ShopEngine plugin to a version newer than 4.8.5 or disable it if no fix is available.
Other vulnerabilities in ShopEngine Elementor WooCommerce Builder Addon
See all- CVE-2026-19088Medium
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before version 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
- CVE-2025-10173Low
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Original NVD description (English source)
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS