Stored Cross-Site Scripting Vulnerability in Product Subtitle for WooCommerce Plugin by WordPress

CVE-2025-5285

What is CVE-2025-5285?

The Product Subtitle for WooCommerce plugin is susceptible to a Stored Cross-Site Scripting vulnerability stemming from improper input validation and output sanitization. Authenticated users with Contributor privileges can exploit this flaw through the ‘htmlTag’ parameter, allowing them to inject malicious web scripts. When a page containing these scripts is accessed by other users, the scripts execute, potentially compromising their browsing experience and data integrity.

References