The vulnerability CVE-2025-22803 affects the VillaTheme Advanced Product Information for WooCommerce plugin (versions up to 1.1.4). It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected WooCommerce plugin, potentially leading to limited disclosure or modification of data and some disruption of service. The impact is rated medium with partial loss of confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor VillaTheme's official channels for updates. Until a fix is available, consider restricting user input or applying web application firewall (WAF) rules to detect and block potential XSS payloads related to this plugin. Avoid granting unnecessary privileges to users who can input data processed by this plugin.