Stored Cross-site Scripting Vulnerability in WPFactory's WooCommerce Product Tabs
CVE-2025-26749

6.5MEDIUM

Key Information:

Vendor

WPfactory

Status
Additional Custom Product Tabs For WooCommerce
Vendor
CVE Published:
15 April 2025

What is CVE-2025-26749?

A Stored Cross-site Scripting (XSS) vulnerability in WPFactory's Additional Custom Product Tabs for WooCommerce plugin permits attackers to inject malicious scripts into web pages viewed by users. This issue arises due to improper neutralization of input, allowing compromised data to be stored and executed within the application. The vulnerability impacts versions from n/a through 1.7.0, making it crucial for website owners to address it swiftly to protect user data and site integrity.

Affected Version(s)

Additional Custom Product Tabs for WooCommerce <= 1.7.0

References

https://patchstack.com/database/wordpress/plugin/product-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.