CVE-2025-67971
Reflected XSS in FluentCart Plugin Allows Webpage Script Injection
Publication date: 2026-02-20
Last updated on: 2026-02-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpmanageninja | fluentcart | to 1.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67971 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress FluentCart plugin versions prior to 1.3.0.
This vulnerability allows unauthenticated attackers to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into websites using the vulnerable plugin.
These malicious scripts execute when site visitors access the compromised pages.
Successful exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'The vulnerability can lead to the execution of malicious scripts on your website, which can result in unauthorized redirects, display of unwanted advertisements, or other harmful HTML payloads.'}, {'type': 'paragraph', 'content': "This can compromise the security and integrity of your website, potentially harming your users and damaging your site's reputation."}, {'type': 'paragraph', 'content': 'Exploitation requires user interaction, but once triggered, it can affect privileged users and site visitors.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2025-67971 is a reflected Cross Site Scripting (XSS) vulnerability in the WordPress FluentCart plugin versions prior to 1.3.0. Detection typically involves identifying malicious script injections in web requests or responses related to the plugin.
While no specific commands are provided, common detection methods include monitoring HTTP traffic for suspicious payloads, using web vulnerability scanners that test for reflected XSS, or searching server logs for unusual query parameters or script tags.
- Use a web vulnerability scanner configured to test for reflected XSS vulnerabilities on pages served by FluentCart.
- Inspect HTTP requests and responses for injected scripts or unusual parameters that could indicate exploitation attempts.
- Review server logs for suspicious URL parameters or POST data that include script tags or encoded payloads.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation for CVE-2025-67971 is to update the FluentCart plugin to version 1.3.0 or later, where the vulnerability has been patched.
Until the update can be applied, Patchstack provides a mitigation rule to block attacks targeting this vulnerability.
Additionally, enabling auto-update options for the FluentCart plugin can help ensure rapid protection against this and future vulnerabilities.