Stored Cross-Site Scripting Vulnerability in VillaTheme Email Template Customizer for WooCommerce

CVE-2025-64200

What is CVE-2025-64200?

The Email Template Customizer for WooCommerce by VillaTheme features a vulnerability that allows stored cross-site scripting (XSS) attacks. This security flaw occurs due to improper handling of user input during web page generation, enabling attackers to inject malicious scripts that can be executed in the context of users' browsers. Consequently, this can lead to unauthorized access, data compromise, and potentially severe impacts on the site's security and user experience. The affected versions include all prior to 1.2.17.

References