CVE-2025-22360 describes a reflected cross-site scripting vulnerability in the promact WP Azure offload plugin (versions up to 2.0). The vulnerability results from improper input neutralization during web page generation, enabling attackers to inject and execute arbitrary scripts in the context of the affected web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation. No active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the WP Azure offload service, potentially leading to data disclosure, modification, or disruption of service. The vulnerability affects confidentiality, integrity, and availability to a low degree but is considered high severity due to the scope change and ease of exploitation over the network without privileges.

A patch is available for this vulnerability. Since WP Azure offload is a cloud-hosted service, the vendor manages remediation server-side. Users and administrators should verify with the vendor advisory that the service has been updated to the patched version. No additional user action is required if the vendor has applied the fix. Patch status should be confirmed by consulting the vendor advisory.