CVE-2025-2635 is a reflected cross-site scripting vulnerability in the codeverve Digital License Manager WordPress plugin. The issue stems from the use of the remove_query_arg() function without proper escaping of URL parameters, enabling injection of arbitrary web scripts. This affects all plugin versions up to and including 1.7.3. An attacker can exploit this by convincing a user to click a maliciously crafted link, causing script execution in the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website via reflected XSS. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of web content. There is no direct impact on system availability. The vulnerability requires user interaction (clicking a crafted link) and affects all versions up to 1.7.3 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or removing the affected plugin if possible. Monitor for vendor updates regarding patches or official mitigations.