CVE-2025-22818 describes a stored cross-site scripting vulnerability in the S3Bubble S3Player – WooCommerce & Elementor Integration plugin for WooCommerce and Elementor. The vulnerability is due to improper input neutralization during web page generation, which allows attackers to inject malicious scripts that persist and execute in users' browsers. This affects versions up to and including 4.2.1. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation. No known exploits have been reported.

Successful exploitation can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users, impacting confidentiality, integrity, and availability at a limited level. However, no known exploits are currently reported in the wild.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated. No additional action is required if the vendor confirms mitigation.