Stored Cross-Site Scripting Vulnerability in Woocommerce - Products By Custom Tax for WordPress

CVE-2025-11821

What is CVE-2025-11821?

The Woocommerce – Products By Custom Tax plugin for WordPress allows for a Stored Cross-Site Scripting vulnerability through the 'woo_products_custom_tax' shortcode. This vulnerability arises from inadequate input sanitization and output escaping for user-supplied attributes, enabling authenticated attackers with contributor-level access or higher to inject malicious scripts. These scripts can execute whenever users access the compromised pages, potentially leading to unauthorized actions or theft of sensitive information.

References