CVE-2026-13725 is a reflected XSS vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin prior to version 5.0.0. The vulnerability occurs because the plugin fails to validate a nonce or user capabilities on a specific AJAX action, and it reflects unsanitized user input in the AJAX response. This enables unauthenticated attackers to perform reflected Cross-Site Scripting attacks by tricking victims into sending crafted requests, potentially leading to script execution in the victim's browser.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected AJAX functionality or applying custom code to validate nonces and sanitize inputs. Monitor the vendor's official channels for updates and apply the update to version 5.0.0 or later once released.