CVE-2025-1505 is a reflected cross-site scripting vulnerability (CWE-79) in the Advanced AJAX Product Filters plugin for WordPress, affecting all versions up to 1.6.8.1. The vulnerability occurs due to improper neutralization of input in the 'nonce' parameter, which is not sufficiently sanitized or escaped before being included in web page output. This flaw enables unauthenticated attackers to inject malicious scripts that execute in the context of users who click on crafted links, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

Successful exploitation allows unauthenticated attackers to perform reflected XSS attacks by injecting arbitrary web scripts via the 'nonce' parameter. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of web content for affected users who interact with malicious links. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying temporary mitigations such as disabling the plugin or restricting access to affected functionality. Monitor the vendor's communications for updates on patches or official fixes.