Security readout for executives and security teams
Plain-English summary
This CVE is a cross-site scripting issue in the Stripe Add-on for iThemes Exchange on WordPress. Affected sites are those running versions before 1.2.0. The available sources do not provide CVSS scoring, exploit details, or evidence of active exploitation, so urgency depends on whether the vulnerable add-on is still installed.
Executive priority
Handle during normal vulnerability remediation unless the vulnerable add-on is present on payment-related WordPress sites. Escalate if the site is internet-facing, still processes transactions, or has many privileged users.
Technical view
CVE-2015-9374 describes XSS in Stripe Add-on for iThemes Exchange before 1.2.0, associated with use of add_query_arg() and remove_query_arg(). The CVE record does not list CVSS, CWE, CPE, or detailed affected package metadata. Public references are Sucuri and iThemes advisories from the coordinated WordPress plugin update context.
Likely exposure
Exposure is likely limited to WordPress sites that installed the Stripe Add-on for iThemes Exchange and have not updated beyond version 1.2.0. The bundled CVE metadata does not identify broader affected products or CPEs.
Exploitation context
The source bundle does not show KEV listing, confirmed exploitation, exploit availability, or attack prerequisites. Treat this as a potentially user-triggered web XSS risk until vendor guidance or local testing proves otherwise.
Researcher notes
Evidence is sparse: the CVE title and description identify XSS and the fixed boundary before 1.2.0, but no CVSS, CWE, CPE, exploit status, or detailed vulnerable parameter is included in the provided bundle.
Mitigation direction
- Upgrade the Stripe Add-on for iThemes Exchange to version 1.2.0 or later.
- Remove the add-on if it is no longer business-required.
- Check iThemes guidance for any additional remediation instructions.
- Prioritize sites where privileged WordPress users access payment administration pages.
Validation and detection
- Inventory WordPress sites for the Stripe Add-on for iThemes Exchange.
- Confirm installed add-on versions are 1.2.0 or later.
- Review the referenced Sucuri and iThemes advisories for affected plugin details.
- Check whether exposed sites still use iThemes Exchange payment workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9374 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.htmlCVE reference · x_refsource_MISC
- https://ithemes.com/coordinated-wordpress-plugin-security-update/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.