The WP2LEADS plugin for WordPress, developed by Saleswonder Team: Tobias, contains a reflected cross-site scripting vulnerability identified as CVE-2025-24565. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser. The issue affects all versions up to 3.3.3. The CVSS 3.1 base score of 7.1 reflects a high-severity vulnerability exploitable over the network without privileges but requiring user interaction. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The reflected XSS nature means the attack requires user interaction, such as clicking a crafted link. The CVSS vector indicates impacts on confidentiality, integrity, and availability, though no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and links related to WP2LEADS. Monitoring vendor channels for updates is recommended.