CVE-2025-13369 is a reflected cross-site scripting vulnerability in the Premmerce WooCommerce Customers Manager plugin for WordPress. It affects all versions up to and including 1.1.14. The vulnerability is due to improper neutralization of input during web page generation, specifically in the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters. An unauthenticated attacker can craft malicious URLs that, when clicked by an administrator, execute arbitrary scripts in the context of the admin's browser session. This vulnerability is classified under CWE-79 and has a CVSS v3.1 score of 6.1 (medium severity).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator's browser session, potentially leading to session hijacking, unauthorized actions, or other impacts related to script execution. The vulnerability requires user interaction (clicking a malicious link) and affects confidentiality and integrity to a limited extent. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links containing the affected parameters. Monitoring for updates from the Premmerce plugin vendor is recommended to apply any forthcoming patches promptly.