Medium severity · published Nov 14, 2025
CVE-2025-13186
A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Isshue · Bdtask
through 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13186
Exploit
https://github.com/4m3rr0r/PoCVulDb/blob/main/README18.md
Permissions Required
https://vuldb.com/?ctiid.332474
Third Party Advisory
https://vuldb.com/?id.332474
Third Party Advisory
https://vuldb.com/?submit.685036
More from Isshue
7.5
CVE-2025-13239
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5
5.1
CVE-2025-40679
HTML injection in Isshue from Bdtask
4.8
CVE-2021-47769
Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)