{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9372", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-22T19:48:19.005Z", "datePublished": "2025-10-03T11:17:17.607Z", "dateUpdated": "2026-04-08T17:09:17.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:17.636Z"}, "affected": [{"vendor": "gbsdeveloper", "product": "Ultimate Multi Design Video Carousel", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91aaf15f-dc47-4f7f-b5f7-aba7c67f7233?source=cve"}, {"url": "https://wordpress.org/plugins/ultimate-multi-design-video-carousel/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-02T22:32:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:16:18.631436Z", "id": "CVE-2025-9372", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:16:30.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9372", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T18:16:18.631436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:16:24.572Z"}}], "cna": {"title": "Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "gbsdeveloper", "product": "Ultimate Multi Design Video Carousel", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:32:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91aaf15f-dc47-4f7f-b5f7-aba7c67f7233?source=cve"}, {"url": "https://wordpress.org/plugins/ultimate-multi-design-video-carousel/"}], "descriptions": [{"lang": "en", "value": "The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:17.636Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9372", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:17.636Z", "dateReserved": "2025-08-22T19:48:19.005Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:17.607Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "id": "CVE-2025-9372", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-03T12:15:48.277", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/ultimate-multi-design-video-carousel/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91aaf15f-dc47-4f7f-b5f7-aba7c67f7233?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:34:05.961145+00:00", "value": {"mitigation_remediation": ["Update the Ultimate Multi Design Video Carousel plugin to the latest version (1.5 or newer) which removes the sanitization issue.", "If a patch is not immediately available, disable or uninstall the plugin from all sites to eliminate the stored XSS vector.", "Restrict editor privileges so that no account can edit carousel content until the patch is applied, using role\u2011management tools or by promoting editors to authors.", "Review all existing carousel entries and delete or sanitize any that contain injected scripts."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All versions of the gbsdeveloper Ultimate Multi Design Video Carousel plugin up to and including 1.4 on WordPress multi\u2011site installations, particularly where the unfiltered_html capability is disabled. The vulnerability applies to any site that hosts carousel entries created by editors.", "description_and_impact": "The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to stored cross\u2011site scripting due to insufficient input sanitization and output escaping. An authenticated user with editor\u2011level permissions can inject arbitrary JavaScript into carousel entries, which will execute whenever any user views a page containing the affected content. This flaw can be exploited to steal session cookies, deface the site, or execute further client\u2011side attacks.", "risk_and_exploitability": "The flaw carries a CVSS score of 5.5 and an EPSS score of <1%, indicating a moderate severity and a low likelihood of exploitation at the time of analysis. It is not currently listed in CISA\u2019s KEV catalog. Attackers must first authenticate as an editor or higher and have permission to create or edit carousel items. Once a script is injected, it runs in the browsers of all users who view the affected carousel, enabling information theft or defacement. The attack vector is local to the CMS, but the impact is observed by every site visitor."}}}}, "created": "2025-10-06T14:42:45.650227+00:00", "updated": "2026-04-21T02:45:25.941097+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}