CVE-2025-49434: WordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through <= 1.4.2.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stijnvanderree Laposta WooCommerce allows Stored XSS. This issue affects Laposta WooCommerce: from n/a through 1.9.1.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49434?
CVE-2025-49434 is categorized as a high severity vulnerability due to its potential for Stored Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-49434?
To fix CVE-2025-49434, upgrade Laposta WooCommerce to version 1.9.2 or later.
What versions of Laposta WooCommerce are affected by CVE-2025-49434?
CVE-2025-49434 affects all versions of Laposta WooCommerce from n/a up to and including version 1.9.1.
What is Stored XSS in relation to CVE-2025-49434?
Stored XSS in CVE-2025-49434 allows attackers to inject malicious scripts that can be executed when users load the affected web pages.
Who is the vendor for CVE-2025-49434?
The vendor for CVE-2025-49434 is Stijn van der Ree, the author of the Laposta WooCommerce plugin.