The vulnerability CVE-2025-39579 in WP Swings Membership For WooCommerce arises from improper neutralization of input during web page generation, enabling DOM-based cross-site scripting (XSS). This allows an attacker with low privileges and requiring user interaction to potentially execute arbitrary code in the context of the affected web application. The affected versions include all releases up to 2.8.0. The CVSS score is 6.5 (medium severity), reflecting limited confidentiality, integrity, and availability impacts. No known exploits in the wild or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts within the context of the affected application. The attack requires user interaction and some privileges, limiting its scope. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the vendor once available.