PT-2025-53812 · Unknown · Kemal Yazici Product Puller

João Pedro S Alcântara · CVE-2025-23550 · Published 2025-12-29 · Updated 2026-01-04

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kemal YAZICI Product Puller versions through 1.5.1

Description The software contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-Site Scripting (XSS). This means that malicious code can be injected into web pages viewed by users. The affected product is Kemal YAZICI Product Puller.

Recommendations Update Kemal YAZICI Product Puller to a version later than 1.5.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23550

Affected Products

Kemal Yazici Product Puller

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-23550 · Security Note
• https://patchstack.com/database/wordpress/plugin/product-puller/vulnerability/wordpress-product-puller-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/2007769014878318837 · Twitter Post
• https://twitter.com/CVEnew/status/2005809468953551171 · Twitter Post
• https://t.me/CVEtracker/40895 · Telegram Post
• https://vdp.patchstack.com/database/wordpress/plugin/product-puller/vulnerability/wordpress-product-puller-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/product-puller/vulnerability/wordpress-product-puller-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note