The vulnerability CVE-2025-32507 involves improper neutralization of input in the Event Espresso – Custom Email Template Shortcode plugin, leading to reflected Cross-site Scripting (XSS). This allows an attacker to inject malicious scripts into web pages generated by the plugin. The affected versions are from initial releases through version 1.0.0. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or disruption of service. The reflected XSS nature means the attack requires user interaction (e.g., clicking a crafted link). The CVSS score of 7.1 reflects a high severity impact with potential confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the affected plugin to mitigate risk. Monitor official sources for updates and patches from the vendor.