CVE-2025-5125

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Custom Post Carousels with Owl	< 1.4.12

References

https://wpscan.com/vulnerability/aaf9e3f8-b312-432d-a635-6fe89ff8d13f/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/aaf9e3f8-b312-432d-a635-6fe89ff8d13f/Exploit, Third Party Advisory

Timeline

Published: Jun 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-51268.8A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\appli CVE-2025-51275.4A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executi CVE-2025-51289.8A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0. Affected is an unknown functi CVE-2025-512817.0D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function. This vulnerability al CVE-2025-51296.3A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknow CVE-2025-51307.2A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of CVE-2025-513066.5In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without ex CVE-2025-513085.3In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read CVE-2025-51317.2A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCate CVE-2025-51328.8A vulnerability was found in Tmall Demo up to 20250505. It has been rated as problematic. This issue affects some unknown processing of the CVE-2025-51336.1A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Sear CVE-2025-51346.1A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality