CVE-2025-32180

MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue ...

Affects 0 products across 2 vendors.

CVSS 3.16.5
EPSS0.3%
Percentile18th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, requires user interaction, can impact systems beyond the vulnerable component.
CWE Weakness Definitions
CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

Related Attack Patterns (CAPEC)
CAPEC-85 AJAX Footprinting
via CWE-79
CAPEC-209 XSS Using MIME Type Mismatch
via CWE-79
CAPEC-588 DOM-Based XSS
via CWE-79
CAPEC-591 Reflected XSS
via CWE-79
CAPEC-592 Stored XSS
via CWE-79
Show all 6
via CWE-79

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Cross-site Scripting (XSS) vulnerability exists in mojofywp Product Carousel For WooCommerce – WoorouSell, versions up to and including 1.1.0, due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to execute arbitrary scripts in the context of other users' browsers, potentially leading to unauthorized actions or data theft.

BSID: BS-2025-GLOBAL-253778-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-32180?
A Cross-site Scripting (XSS) vulnerability exists in mojofywp Product Carousel For WooCommerce – WoorouSell, versions up to and including 1.1.0, due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to execute arbitrary scripts in the context of other users' browsers, potentially leading to unauthorized actions or data theft.
What is the CVSS score for CVE-2025-32180?
CVE-2025-32180 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS: 0.3%.
Is CVE-2025-32180 actively exploited?
No confirmed active exploitation of CVE-2025-32180 as of 2026-05-30.
How do I remediate CVE-2025-32180?
Priority: HIGH.
What systems are affected by CVE-2025-32180?
CVE-2025-32180 affects Mojofywp; Woocommerce.
Vulnerability Details
CVE IDCVE-2025-32180
BSIDBS-2025-GLOBAL-253778-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Published2025-05-16
Last Modified2026-04-23
ICS Relevance0%
Weakness (CWE)
Cross-Site Scripting (XSS)
SourceNVD
Official Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through <= 1.1.0.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting malicious scripts into the input fields of the Product Carousel For WooCommerce – WoorouSell plugin. When other users view the affected pages, the scripts are executed in their browsers, potentially compromising their session data or leading to further attacks.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Mojofywp — —
Woocommerce — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 517 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashd0cef706ae1d9be35690dfa005fb127cda2343b05b80fcdec8796bb9c77b2ec3af07f6c7fc085228a7c0d2c42e1aad517bb50f837713f9e1c8cade697d88f7b5
Related CVEs affecting Mojofywp
CVE-2025-22724 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2022-4974 6.3 The Freemius SDK, as used by hundreds of WordPress plugin and theme developer... CVE-2023-52178 5.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2023-47232 4.3 Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.Thi...
View all Mojofywp CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →