CVE-2025-32628: WordPress Crowdfunding for WooCommerce Plugin <= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Crowdfunding for WooCommerce allows Reflected XSS. This issue affects Crowdfunding for WooCommerce: from n/a through 3.1.12.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Crowdfunding for WooCommerce crowdfunding-for-woocommerce allows Reflected XSS.This issue affects Crowdfunding for WooCommerce: from n/a through <= 3.1.12.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32628?
CVE-2025-32628 is a Cross-site Scripting (XSS) vulnerability that can allow attackers to inject malicious scripts into web pages.
How do I fix CVE-2025-32628?
To fix CVE-2025-32628, update the Crowdfunding for WooCommerce plugin to version 3.1.13 or later.
What versions of Crowdfunding for WooCommerce are affected by CVE-2025-32628?
CVE-2025-32628 affects Crowdfunding for WooCommerce from versions n/a through 3.1.12.
What type of vulnerability is CVE-2025-32628?
CVE-2025-32628 is classified as a reflected Cross-site Scripting (XSS) vulnerability.
Can CVE-2025-32628 be exploited remotely?
Yes, CVE-2025-32628 can be exploited remotely, allowing attackers to execute scripts in the context of the user's session.