PT-2025-49338 · WordPress · Woomotiv+1

Published 2025-12-06 · Updated 2025-12-06 · CVE-2025-13137

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress versions up to and including 3.6.3

Description The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of the woomotiv limit parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a link. The vulnerable parameter is woomotiv limit.

Recommendations Versions prior to and including 3.6.3 are affected.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13137

Affected Products

Live Sales Notification For Woocommerce

Woomotiv

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13137 · Security Note
• https://wordpress.org/plugins/woomotiv · Note
• https://t.me/CVEtracker/38981 · Telegram Post
• https://twitter.com/CVEnew/status/1997196810172223600 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997235330135494878 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/19257e49-addb-4882-af5f-8de0d90a4a86?source=cve · Note