{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1491", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-19T22:41:12.031Z", "datePublished": "2025-03-01T12:22:40.818Z", "dateUpdated": "2026-04-08T17:03:21.945Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:21.945Z"}, "affected": [{"vendor": "teastudiopl", "product": "WP Posts Carousel", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018auto_play_timeout\u2019 parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=cve"}, {"url": "https://wordpress.org/plugins/wp-posts-carousel/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3248502/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "timeline": [{"time": "2025-03-01T00:08:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-03T16:00:42.045793Z", "id": "CVE-2025-1491", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-03T17:38:08.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1491", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-03T16:00:42.045793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-03T16:00:43.847Z"}}], "cna": {"title": "WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "teastudiopl", "product": "WP Posts Carousel", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-01T00:08:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=cve"}, {"url": "https://wordpress.org/plugins/wp-posts-carousel/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3248502/"}], "descriptions": [{"lang": "en", "value": "The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018auto_play_timeout\u2019 parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-01T12:22:40.818Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1491", "state": "PUBLISHED", "dateUpdated": "2025-03-03T17:38:08.752Z", "dateReserved": "2025-02-19T22:41:12.031Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-01T12:22:40.818Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018auto_play_timeout\u2019 parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WP Posts Carousel para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del par\u00e1metro 'auto_play_timeout' en todas las versiones hasta la 1.3.7 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1491", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-01T13:15:10.750", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3248502/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-posts-carousel/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:07:59.759926+00:00", "value": {"mitigation_remediation": ["Upgrade WP Posts Carousel to the latest supported version, which implements proper input sanitization and output escaping for the auto_play_timeout field.", "If an upgrade is not immediately feasible, disable or remove the auto_play_timeout setting from the plugin\u2019s configuration or uninstall the plugin entirely to eliminate the vulnerable input vector.", "Limit Contributor\u2011level access in the WordPress site, ensuring that only trusted users can manage or configure this plugin, thereby reducing the opportunity for malicious code injection."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors or higher to inject arbitrary scripts via the auto_play_timeout parameter"}, "threat_synthesis": {"affected_systems": "All installations of the WP Posts Carousel plugin for WordPress with version 1.3.7 or earlier, developed by TeastudioPL. The vulnerability applies to any WordPress installation that has the plugin enabled and an authenticated user with Contributor or higher privileges. No specific WordPress core versions are mentioned, so the risk applies broadly to sites running the affected plugin version.", "description_and_impact": "The WP Posts Carousel plugin is vulnerable to stored Cross\u2011Site Scripting because the auto_play_timeout parameter is not properly sanitized or escaped. An authenticated user with Contributor-level or higher can submit a malicious payload that is persisted and executed whenever any user accesses a page that processes this parameter. This enables script injection that can steal session data, deface content, or redirect users, compromising confidentiality, integrity, and potentially availability of the affected WordPress site. The vulnerability is limited to pages that use the malicious input, but the impact is significant because the payload runs in the context of any visitor to those pages.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% reflects a very low predicted exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor or higher to create a malicious value for auto_play_timeout, so the primary attack vector is via the plugin\u2019s configuration interface within a controlled WordPress installation. Once injected, the payload survives as stored data and executes for any user browsing the affected page, giving the attacker persistent influence over user experience and potential data theft."}}}}, "created": "2025-07-12T22:23:57.739394+00:00", "updated": "2026-04-21T22:15:45.902247+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}