The vulnerability CVE-2025-22358 affects Simone Marcon's Wp advertising management plugin for WordPress, specifically versions up to 1.0.3. It is a reflected Cross-site Scripting (XSS) flaw caused by improper input sanitization during web page generation. An attacker could exploit this by crafting malicious input that is reflected in the web page output, potentially leading to script execution in the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application users, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is rated high due to the ability to affect confidentiality, integrity, and availability, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin version and apply web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor vendor channels for updates and apply patches promptly once available.