CVE-2025-2169: WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
First published: Tue Mar 11 2025(Updated: )
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pluginus WordPress Currency Switcher Professional | <=1.2.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb24ae0-41d6-4d8f-917c-dfd058a7a49d?source=cve
- https://plugins.trac.wordpress.org/browser/currency-switcher/trunk/index.php#L1920
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249625%40currency-switcher&new=3249625%40currency-switcher&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253183%40currency-switcher&new=3253183%40currency-switcher&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2025-2169?
CVE-2025-2169 is considered a critical vulnerability due to the risk of arbitrary shortcode execution.
How do I fix CVE-2025-2169?
To mitigate CVE-2025-2169, update the WPCS – WordPress Currency Switcher Professional plugin to version 1.2.0.5 or later.
What versions of WPCS are affected by CVE-2025-2169?
All versions of WPCS – WordPress Currency Switcher Professional up to and including 1.2.0.4 are affected by CVE-2025-2169.
Can CVE-2025-2169 be exploited remotely?
Yes, CVE-2025-2169 can be exploited remotely by an attacker to execute arbitrary shortcodes.
Is there a known exploit for CVE-2025-2169?
While there are no publicly disclosed exploits for CVE-2025-2169 at this time, the vulnerability's nature allows for potential exploitation.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/severity
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpcs
- canonical/pluginus wordpress currency switcher professional