Cross-Site Scripting Vulnerability in Booster for WooCommerce by WordPress

CVE-2025-64196

What is CVE-2025-64196?

A Cross-Site Scripting vulnerability has been identified in the Booster for WooCommerce plugin for WordPress, allowing attackers to inject malicious scripts into web pages. This flaw is present in versions from an unspecified release up to and including 7.2.5. If exploited, it can lead to the execution of arbitrary scripts in the context of the affected user’s browser, potentially compromising sensitive information or hijacking user sessions. Users of the affected product are urged to update to the latest version to mitigate this risk.

References