CVE-2025-32115

WordPress Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Published Apr 10, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light allows Reflected XSS.This issue affects Popping Content Light: from n/a through <= 2.4.

Analysis

Technical impact

The Popping Content Light plugin for WordPress contains an improper neutralization of input during web page generation, allowing a reflected cross‑site scripting attack. An external user can provide specially crafted input that is echoed back in the page, enabling the execution of arbitrary client‑side scripts. This flaw can be used to alter the displayed content or interact with the site in unintended ways.

Affected Systems

The vulnerability affects any installation of the OTWthemes Popping Content Light WordPress plugin version 2.4 and earlier, including all releases from the earliest build up to and including 2.4.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium‑to‑high severity level. The EPSS score of less than 1% suggests the probability of exploitation is very low. The vulnerability is not listed in CISA KEV. The likely attack vector is a web‑based user accessing a malicious URL or input field that is reflected by the plugin, which requires the victim to load the crafted content in a browser. The overall risk is significant for sites that expose the plugin to external users, but the likelihood of exploitation remains low based on current evidence.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OTWthemes

Popping Content Light

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OTWthemes Popping Content Light to a version newer than 2.4, or uninstall the plugin if it is not required.
If an update is delayed, disable the plugin or the specific features that process external input until a fix is available to prevent reflected XSS payloads.
Deploy a Web Application Firewall or implement a Content Security Policy that restricts script execution and blocks unexpected injection patterns for additional protection.

Generated by OpenCVE AI on May 1, 2026 at 10:42 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-10482	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light allows Reflected XSS. This issue affects Popping Content Light: from n/a through 2.4.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.299% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/popping-content-light/vulnerability/wordpress-popping-content-light-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light allows Reflected XSS. This issue affects Popping Content Light: from n/a through 2.4.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light allows Reflected XSS.This issue affects Popping Content Light: from n/a through <= 2.4.
References	https://patchstack.com/database/wordpress/plugin/popping-content-light/vulnerability/wordpress-popping-content-light-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/popping-content-light/vulnerability/wordpress-popping-content-light-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 10, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 10, 2025 8:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light allows Reflected XSS. This issue affects Popping Content Light: from n/a through 2.4.
Title		WordPress Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/popping-content-light/vulnerability/wordpress-popping-content-light-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`