CVE-2025-32586 describes a reflected cross-site scripting vulnerability in the ABA PayWay Payment Gateway for WooCommerce plugin (versions up to 2.1.4). The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject and execute malicious scripts via crafted input. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating that it can be exploited remotely without privileges but requires user interaction, and can lead to partial confidentiality, integrity, and availability impacts. No patch or vendor advisory is currently provided, and no known active exploitation is reported.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session when interacting with the affected plugin. This can lead to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. The CVSS score of 7.1 reflects a high severity impact, but no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor the vendor's communications for updates. Until a fix is released, consider applying temporary mitigations such as disabling the plugin if feasible or restricting access to affected functionality. Avoid clicking on suspicious links that may trigger reflected XSS attacks.