The vulnerability CVE-2025-58786 affects the Ibtana – Ecommerce Product Addons plugin by VW THEMES, specifically versions up to 0.4.7.6. It is a DOM-based Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability is published and assigned by Patchstack but lacks a vendor patch or advisory at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates that the attacker needs low privileges and user interaction, and the attack can affect confidentiality, integrity, and availability to a limited extent. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting user input where feasible and applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates regarding patches or official workarounds.