Reflected Cross-Site Scripting Vulnerability in Woomotiv Plugin for WordPress
CVE-2025-13137
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 December 2025
What is CVE-2025-13137?
The Woomotiv plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'woomotiv_limit' parameter. This vulnerability affects all versions up to and including 3.6.3. Attackers can exploit this weakness to inject harmful web scripts into pages, which may execute if a user is tricked into performing an action, such as clicking on a malicious link. Proper sanitation and escaping practices are essential to mitigate this risk.
Affected Version(s)
Live Sales Notification for Woocommerce – Woomotiv * <= 3.6.3