Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-24681: Product Carousel Slider & Grid Ultimate can run malicious scripts

CVE-2025-24681 · published 1 year ago

Summary

The WooCommerce add‑on that creates product carousels and grids stores web page content without properly cleaning it. An attacker could place hidden code that runs in a visitor’s browser, potentially stealing data or altering the site’s appearance. Update the plugin to the latest version or remove it until it is fixed.

Original advisory text

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published24 Jan 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-24681 · NVD

Track software like this

Free during beta