Stored XSS Vulnerability in WPFactory Product Notes for WooCommerce

CVE-2025-48239

What is CVE-2025-48239?

A stored cross-site scripting (XSS) vulnerability exists in the WPFactory Product Notes Tab & Private Admin Notes for WooCommerce plugin. This flaw allows attackers to inject malicious scripts into the application's web pages, which can then be executed in the browsers of users who view these pages. This vulnerability is particularly concerning as it can lead to unauthorized data exposure, session hijacking, and other malicious activities. The affected versions range from any prior version through 3.1.0, making it imperative for users to update to secure their environments.

References