CVE-2025-0350

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0350", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-08T22:01:39.782Z", "datePublished": "2025-01-25T09:22:46.301Z", "dateUpdated": "2026-04-08T17:11:45.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:45.652Z"}, "affected": [{"vendor": "badhonrocks", "product": "Divi Carousel Free (Divi5 Support)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Divi Carousel Maker \u2013 Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e57a85b-3ea8-46df-ab60-ce835268b1f6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/ImageCarouselChild/ImageCarouselChild.php#L327"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168"}, {"url": "https://wordpress.org/plugins/wow-carousel-for-divi-lite/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3226742/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-01-24T20:40:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-27T15:32:53.285557Z", "id": "CVE-2025-0350", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T15:32:58.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0350", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T15:32:53.285557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T15:32:48.062Z"}}], "cna": {"title": "Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "badhonrocks", "product": "Divi Carousel Free (Divi5 Support)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-24T20:40:22.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e57a85b-3ea8-46df-ab60-ce835268b1f6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/ImageCarouselChild/ImageCarouselChild.php#L327"}, {"url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168"}, {"url": "https://wordpress.org/plugins/wow-carousel-for-divi-lite/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3226742/"}], "descriptions": [{"lang": "en", "value": "The Divi Carousel Maker \u2013 Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:45.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0350", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:45.652Z", "dateReserved": "2025-01-08T22:01:39.782Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-25T09:22:46.301Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Divi Carousel Free (Divi5 Support)", "vendor": "badhonrocks", "versions": [{"lessThanOrEqual": "2.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elegantthemes:carousel_maker_for_divi:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E31589D6-2E8B-4501-A57D-BF711D6FD808", "versionEndExcluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Divi Carousel Maker \u2013 Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Divi Carousel Maker \u2013 Image, Logo, Testimonial, Post Carousel &amp; More para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del carrusel de im\u00e1genes y el carrusel de logotipos del complemento en todas las versiones hasta incluida, 2.0.4 debido a la falta de desinfecci\u00f3n de entrada y al escape de salida en los atributos proporcionados por el usuario. Esto hace posible que los atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitraria en las p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0350", "lastModified": "2026-06-17T08:26:19.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0350", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-27T15:32:53.285557Z", "version": "2.0.3"}}]}, "published": "2025-01-25T10:15:08.160", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/ImageCarouselChild/ImageCarouselChild.php#L327"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3226742/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/wow-carousel-for-divi-lite/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e57a85b-3ea8-46df-ab60-ce835268b1f6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:30:56.474005+00:00", "value": {"mitigation_remediation": ["Upgrade the Divi Carousel Maker plugin to a release that contains the XSS fix \u2013 check the plugin repository or vendor site for an updated version.", "If no patch is available yet, remove or disable the Image Carousel and Logo Carousel widgets from publicly exposed pages, or limit contributor\u2011level users from editing those widgets.", "Deploy a Web Application Firewall or use a WordPress security plugin that sanitizes widget input to block JavaScript injections in the affected fields."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected component is the Divi Carousel Free (Divi5 Support) WordPress plugin, version 2.0.4 and all earlier releases. WordPress sites that install this plugin and use any image or logo carousel widget are vulnerable. The CPE entry confirms it is a WordPress plugin from Elegant Themes. Any user with contributor\u2011level or higher access to the site can exploit this flaw.", "description_and_impact": "This vulnerability lies in the Divi Carousel Maker plugin for WordPress and allows an authenticated contributor or higher to inject arbitrary JavaScript into the Image Carousel and Logo Carousel widgets. The input supplied by users is neither sanitized nor properly escaped, so the payload is persisted in the database and executed whenever a visitor loads a page that renders the affected widget. Such injected scripts can be used to hijack user sessions, deface content, or launch phishing attacks. The issue is a classic stored XSS flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests it is not currently widely exploited. Because the flaw is stored, an attacker does not need additional user interaction; any viewer of the injected page will run the malicious script. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated contributor access but does not need additional exploits or configuration changes beyond inserting the malicious payload. This combination of a moderate rating and an authenticated attack vector results in a risk that should be mitigated promptly, especially on sites that are publicly reachable."}}}}, "created": "2026-04-22T13:45:18.281239+00:00", "updated": "2026-04-22T13:45:18.281251+00:00", "vendors": []}