CVE-2025-66572 affects Loaded Commerce 6.6 and involves improper neutralization of special elements in the search parameter, leading to client-side template injection. This vulnerability enables unauthenticated remote attackers to execute arbitrary code on the server, classified under CWE-78 OS Command Injection. The CVSS 4.0 vector indicates the attack can be performed remotely without privileges or user interaction, with low impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code on the server hosting Loaded Commerce 6.6. This could lead to unauthorized control over the affected system, potentially compromising data confidentiality, integrity, and availability. However, the CVSS score and vector indicate the impact is medium, with limited impact on system components and no required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor vendor communications for updates. In the meantime, restricting access to the search functionality or implementing input validation and sanitization on the search parameter may reduce risk.