Security readout for executives and security teams
Plain-English summary
This CVE affects an old WordPress tax add-on used with iThemes Exchange. Sites running Easy Canadian Sales Taxes Add-on before 1.1.0 may allow cross-site scripting, letting attacker-supplied script run in a visitor or administrator browser. The provided sources do not show active exploitation.
Executive priority
Prioritize if the affected add-on exists on a live or administrator-used WordPress site. The issue is old and lacks active-exploitation evidence here, but XSS can still support account compromise or content tampering.
Technical view
The issue is XSS in Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0, tied to add_query_arg() and remove_query_arg() handling. The bundle provides no CVSS, CWE, vulnerable parameter, or execution context. Treat it as a legacy WordPress plugin exposure needing version verification.
Likely exposure
Exposure is likely limited to WordPress sites that installed iThemes Exchange plus the Easy Canadian Sales Taxes Add-on below version 1.1.0. Sites without this add-on are not implicated by the supplied sources.
Exploitation context
CISA KEV is false, and the supplied bundle does not cite active exploitation. Public references identify a coordinated WordPress plugin XSS update, but do not provide exploit prevalence or confirmed exploitation for this CVE.
Researcher notes
Evidence is sparse: no CVSS, CWE, vulnerable route, parameter, or proof-of-concept is included. Focus validation on installed plugin/version state and whether legacy WordPress commerce components remain reachable.
Mitigation direction
- Upgrade the add-on to version 1.1.0 or later where available.
- Disable or remove the add-on if it is unused or cannot be updated.
- Check iThemes or successor vendor guidance for legacy support status.
- Restrict WordPress admin access to trusted users while remediation is pending.
Validation and detection
- Inventory WordPress plugins and confirm whether this add-on is installed.
- Verify the installed add-on version is 1.1.0 or later.
- Check whether iThemes Exchange remains deployed on the site.
- Review security logs for suspicious script-like requests around WordPress plugin pages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.htmlCVE reference · x_refsource_MISC
- https://ithemes.com/coordinated-wordpress-plugin-security-update/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.