CVE-2025-26566 describes a reflected cross-site scripting vulnerability in the Frank In Stock Mailer for WooCommerce plugin (versions up to 2.1.1). The issue is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute in users' browsers when they interact with crafted URLs or inputs. The CVSS v3.1 base score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a limited level. The reflected nature means the attack requires the victim to interact with a crafted link or input. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and links related to the In Stock Mailer for WooCommerce plugin. Monitor vendor communications for updates and apply patches promptly once available.