This vulnerability (CVE-2025-39446) in Booster Plus for WooCommerce is caused by improper input sanitization leading to reflected cross-site scripting (CWE-79). It affects all versions up to 7.2.4. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs or web pages generated by the plugin. No patch or official fix has been disclosed yet.

Successful exploitation can result in execution of arbitrary scripts in the context of affected users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high severity with notable impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling or limiting use of the affected plugin or employing web application firewalls (WAF) with rules to detect and block reflected XSS attempts. Monitor vendor channels for updates and apply patches promptly once available.