CVE-2025-32522: WordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Reflected XSS.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.9.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPExperts.io License Manager for WooCommerce allows Reflected XSS. This issue affects License Manager for WooCommerce: from n/a through 3.0.9.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32522?
CVE-2025-32522 has been classified as a reflected cross-site scripting (XSS) vulnerability, which can allow attackers to execute scripts in the context of a user's browser.
How do I fix CVE-2025-32522?
To fix CVE-2025-32522, update the WPExperts.io License Manager for WooCommerce plugin to version 3.0.10 or later.
What versions are affected by CVE-2025-32522?
CVE-2025-32522 affects all versions of WPExperts.io License Manager for WooCommerce up to and including version 3.0.9.
What type of attacks can CVE-2025-32522 lead to?
CVE-2025-32522 can lead to reflected XSS attacks, potentially allowing attackers to steal session cookies or perform actions on behalf of the user.
Is there a workaround for CVE-2025-32522?
There is no official workaround for CVE-2025-32522; the recommended action is to update the plugin to mitigate the risk.