Cross-Site Scripting Vulnerability in Finale Lite by Daman Jeet
CVE-2025-52736

7.1HIGH

Key Information:

Vendor

WordPress
Status
Finale Lite
Vendor
CVE Published:
22 October 2025

What is CVE-2025-52736?

A Cross-Site Scripting (XSS) vulnerability has been identified in the Finale Lite plugin for WooCommerce, specifically impacting versions up to 2.20.0. The flaw arises from improper input validation during web page generation, which allows an attacker to inject malicious scripts. This can lead to the potential compromise of user sessions, data exfiltration, and other harmful actions executed within the context of a victim's browser.

Affected Version(s)

Finale Lite <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/fina...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
JSON
.