This vulnerability (CVE-2025-23789) is a reflected Cross-site Scripting (XSS) issue in the tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce plugin, affecting versions up to 9.0.2. It results from improper input neutralization during web page generation, enabling attackers to inject and execute arbitrary scripts via crafted input. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating the vulnerability is exploitable remotely without privileges but requires user interaction, and can impact confidentiality, integrity, and availability in a scope-changing manner. No patch or vendor advisory details are currently available.

Successful exploitation of this reflected XSS vulnerability can lead to execution of arbitrary scripts in the context of affected users' browsers. This may allow attackers to steal sensitive information, manipulate web content, or perform actions on behalf of the user, impacting confidentiality, integrity, and availability. The vulnerability affects all users of the plugin versions up to 9.0.2. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.