Cross-Site Scripting Vulnerability in WooCommerce Vehicle Parts Finder by wpinstinct

CVE-2025-49911

What is CVE-2025-49911?

The WooCommerce Vehicle Parts Finder plugin by wpinstinct is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw allows an attacker to inject malicious scripts via user inputs, which can be reflected back to the victim. Versions from n/a up to 3.7 are affected, highlighting the importance of upgrading to protect against malicious exploits that can compromise user data and security.

References