CVE-2025-32522

Deeper analysis

The vulnerability is a reflected cross-site scripting flaw (CWE-79) in the License Manager for WooCommerce WordPress plugin, present in all versions through 3.0.9. It stems from improper neutralization of user input during web page generation, allowing malicious scripts to be reflected back to victims. The issue carries a CVSS 3.1 score of 7.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated attacker can exploit the flaw by crafting a malicious URL containing injected script that is served to a logged-in or visiting user. Successful exploitation permits the attacker to execute arbitrary JavaScript in the victim's browser within the context of the affected site, enabling actions such as session hijacking, data theft, or limited site manipulation due to the changed scope in the CVSS vector.

The sole advisory reference is a Patchstack database entry that identifies the reflected XSS issue in the plugin but does not detail specific patches or mitigation steps beyond version information. The associated EPSS score remains low, with a current value of 0.0067 and a peak of 0.0111, indicating limited observed exploitation interest.