CVE-2025-27275 is a reflected Cross-site Scripting vulnerability in the WOO Codice Fiscale plugin (versions up to 1.6.3) by andrew_fisher. It results from improper neutralization of input during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the available data.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt application availability. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction. The scope change means the vulnerability affects components beyond the initially vulnerable component. Confidentiality, integrity, and availability impacts are rated low but combined justify a high severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, applying web application firewall (WAF) rules to detect and block reflected XSS payloads may help mitigate risk. Avoiding untrusted input in URLs or forms that generate web pages can reduce exposure. Do not rely on generic mitigations; wait for vendor guidance or patches.