CVE-2025-22307: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in CodeAstrology Team's Product Table for WooCommerce plugin, tracked as CVE-2025-22307. The vulnerability affects versions through 3.5.6 of the plugin and was discovered by security researcher Le Ngoc Anh. The issue was publicly disclosed on January 6, 2025 (Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping in the Product Table for WooCommerce plugin. It has been assigned a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD, WPScan).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could potentially lead to the execution of malicious scripts, including redirects, advertisements, and other HTML payloads on the affected website (Patchstack).

The vulnerability requires no authentication to exploit, though it does require user interaction. As of the disclosure date, no known exploits have been reported in the wild, but the vulnerability is considered moderately dangerous and is expected to become exploited (Patchstack).

Currently, there is no official fix available from the vendor. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement the virtual patch immediately to protect their sites (Patchstack).