CVE-2025-49042 is a stored cross-site scripting vulnerability in Automattic WooCommerce affecting versions through 10.0.2. It results from improper input neutralization during web page generation, enabling attackers with high privileges to inject malicious scripts that execute when viewed by other users. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and privileges, reducing the likelihood of widespread exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to script injection. Avoid enabling untrusted users to input data that could be rendered in web pages.