The PDF Catalog for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2025-12191. This vulnerability exists in all versions up to 1.1.18 due to inadequate sanitization and escaping of user input in the 'pdfcatalog' AJAX action. Authenticated attackers with at least Subscriber privileges can inject arbitrary JavaScript code that is stored and later executed in the context of other users viewing the affected pages. This can lead to partial compromise of user sessions or other client-side impacts. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

An attacker with Subscriber-level or higher access can inject persistent malicious scripts into pages served by the plugin. These scripts execute in the browsers of users who view the infected pages, potentially allowing theft of session tokens, defacement, or other client-side attacks. The impact affects confidentiality and integrity partially but does not affect availability. The vulnerability requires authentication and user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and consider disabling or limiting use of the 'pdfcatalog' AJAX functionality if possible. Monitor for plugin updates from ovologics and apply official patches promptly once available.