The vulnerability identified as CVE-2025-24668 affects the Themeisle PPOM for WooCommerce plugin, specifically versions up to 33.0.8. It is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers with high privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by other users, potentially leading to limited compromise of user data, session hijacking, or other client-side impacts. The overall impact is rated medium, reflecting limited but non-negligible confidentiality, integrity, and availability effects. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Themeisle's official channels for updates. Until a fix is available, limit administrative access to trusted users only and exercise caution with user-generated content. Avoid unnecessary exposure of the affected plugin if possible.