PT-2025-26279 · WordPress · Custom Post Carousels With Owl

Pierre Rudloff · Published 2025-06-20 · Updated 2025-06-23 · CVE-2025-5125

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Post Carousels with Owl WordPress plugin versions prior to 1.4.12

Description The issue concerns the use of the featherlight library and the data-featherlight attribute without proper sanitization. This could potentially lead to security issues, as unsanitized input can be exploited.

Recommendations For versions prior to 1.4.12, update to version 1.4.12 or later to resolve the issue. As a temporary workaround, consider disabling the use of the featherlight library until a patch is available. Restrict access to the data-featherlight attribute to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-5125

Affected Products

Custom Post Carousels With Owl

References · 7

• 🔥 https://wpscan.com/vulnerability/aaf9e3f8-b312-432d-a635-6fe89ff8d13f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5125 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5125 · Vendor Advisory
• https://t.me/cvenotify/126426 · Telegram Post
• https://t.me/cvetracker/26624 · Telegram Post
• https://twitter.com/CVEnew/status/1936472564483719308 · Twitter Post
• https://t.me/cvenotify/126216 · Telegram Post