WordPress Custom Post Carousels with Owl plugin < 1.4.12 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Custom Post Carousels with Owl versions 1.4.12...

CVE-2025-5125

The Custom Post Carousels with Owl WordPress plugin versions prior to 1.4.12 is vulnerable to a Stored XSS (CWE-79) vulnerability. The root cause is the use of the featherlight library and the data-featherlight attribute without proper sanitization of input. An attacker can exploit this lack of c...

CVE-2025-5125 Custom Post Carousels with Owl < 1.4.12 - Contributor+ Stored XSS

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it...