CVE-2025-62750

The WooCommerce Parcelas plugin for WordPress versions up to and including 1.3.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the DOM of a victim's browser [1].

Exploitation requires user interaction, such as clicking a crafted link or visiting a specially prepared page. The vulnerability can be triggered by any unauthenticated user, making it accessible to remote attackers without prior authentication [1].

Successful exploitation enables an attacker to execute malicious scripts in the context of the victim's session. This can lead to actions such as redirecting users to malicious sites, injecting advertisements, or stealing sensitive information like session cookies [1].

The vendor has not released a patched version; users are advised to update the plugin immediately if a fix becomes available. As a workaround, site administrators should consider disabling the plugin or implementing a web application firewall (WAF) rule to block XSS payloads [1].