CVE-2025-12398 is a reflected cross-site scripting vulnerability in the Product Table for WooCommerce plugin for WordPress. The flaw exists in the handling of the 'search_key' parameter, which is not properly sanitized or escaped before being included in web pages. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they click on a crafted link. The vulnerability affects all versions up to and including 5.0.8. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens. However, the attack requires user interaction (clicking a malicious link) and does not impact availability. The confidentiality and integrity impacts are limited but present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links involving the 'search_key' parameter in the affected plugin. Consider disabling or restricting use of the plugin if possible, or applying web application firewall rules to detect and block suspicious input patterns targeting this parameter.