The vulnerability CVE-2025-69098 in wpWave Hide My WP plugin is a reflected Cross-site Scripting (XSS) issue caused by improper input neutralization during web page generation. It affects all versions up to 6.2.12. An attacker can craft malicious input that is reflected in the web page output, potentially executing arbitrary scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The reflected XSS requires the victim to interact with a crafted link or input. The CVSS score of 7.1 reflects a high severity with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable plugin or applying web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links that could trigger the vulnerability.