The WP_DEBUG Toggle plugin for WordPress, developed by plugins.club, contains a reflected Cross-site Scripting vulnerability identified as CVE-2025-32561. This vulnerability is due to improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are reflected back to users. It affects all versions up to 1.1. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or remediation details have been provided by the vendor or other sources at this time.

Successful exploitation of this reflected XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Since user interaction is required, the attack surface is limited to users who visit a crafted URL or page. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP_DEBUG Toggle plugin if possible, or apply any available temporary mitigations recommended by the vendor. Avoid clicking on suspicious links that could trigger the reflected XSS.