CVE-2025-26749

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Apr 15, 2025
Updated: Apr 16, 2025
CWE ID 79

Summary

CVE-2025-26749 is a Cross-site Scripting (XSS) vulnerability affecting Additional Custom Product Tabs for WooCommerce, from versions n/a through 1.7.0. An attacker can inject malicious scripts into the webpage by exploiting the improper neutralization of user input during webpage generation. Successful exploitation could lead to the compromise of user sessions, data theft, or the installation of malware. Users are advised to update the plugin to the latest version to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share