Medium severity · published Jun 14, 2025
CVE-2025-5238
YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YW
YITH WooCommerce Wishlist · yithemes
through 4.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5238
docs.yithemes.com
https://docs.yithemes.com/yith-woocommerce-wishlist/changelog/changelog-free-version/
plugins.svn.wordpress.org
https://plugins.svn.wordpress.org/yith-woocommerce-wishlist/tags/4.5.0/assets/js/unminified/jquery.yith-wcwl.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3310555/
wordpress.org
https://wordpress.org/plugins/yith-woocommerce-wishlist/#description
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4b0434-61ca-47b1-9119-7208283f916f?source=cve
More from YITH WooCommerce Wishlist
5.9
CVE-2024-34385
WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability
5.3
CVE-2025-12427
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename
5.3
CVE-2025-12777
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
4.3
CVE-2019-16251
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes