The vulnerability identified as CVE-2025-50027 affects the xootix Login/Signup Popup plugin for WooCommerce (versions up to 2.9.4). It is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. An attacker with high privileges and requiring user interaction can exploit this vulnerability to execute arbitrary scripts in the context of the affected application. The CVSS 3.1 base score is 5.9, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and no known exploits have been observed in the wild. The vulnerability was published on June 20, 2025.

Successful exploitation of this vulnerability can lead to execution of malicious scripts in users' browsers, potentially resulting in data theft, session hijacking, or other unauthorized actions affecting confidentiality, integrity, and availability. The attack requires high privileges and user interaction, which somewhat limits the ease of exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin features to trusted users only and monitor for suspicious activity related to the Login/Signup Popup. Avoid exposing the vulnerable plugin to untrusted users where possible.