CVE-2025-32541

WordPress WooCommerce Sales MIS Report Plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Published Apr 11, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report woocommerce-mis-report allows Reflected XSS.This issue affects WooCommerce Sales MIS Report: from n/a through <= 4.0.3.

Analysis

Technical impact

This vulnerability arises from improper neutralization of user input that is reflected back in the web page, allowing arbitrary JavaScript execution when a crafted request is visited. The injected script can steal user credentials, deface the site, or redirect to malicious URLs, effectively compromising confidentiality, integrity, and availability for affected users.

Affected Systems

Any WordPress installation that has the WooCommerce Sales MIS Report plugin from infosoftplugin with a version up to and including 4.0.3 is affected. The vulnerability is present in every release from the earliest version through 4.0.3.

Risk and Exploitability

The CVSS severity of 7.1 classifies it as high risk. The EPSS score of less than 1% suggests that exploitation is currently rare, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote web request that contains malicious input, and the exploit requires a victim user to visit a crafted URL. While the probability of indiscriminate exploitation is low, the impact of a successful attack is significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

infosoftplugin

WooCommerce Sales MIS Report

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.0.3

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the WooCommerce Sales MIS Report plugin to a version newer than 4.0.3; if no such version exists, replace the plugin with a maintained alternative.
Disable or remove any exposed input parameters or features that echo user data back to the page, ensuring the plugin does not render unsanitized input.
Implement strict content‑security‑policy headers and, if possible, conduct a code audit to enforce proper output escaping for all remaining plugin input fields.

Generated by OpenCVE AI on April 30, 2026 at 23:09 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-10764	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report allows Reflected XSS. This issue affects WooCommerce Sales MIS Report: from n/a through 4.0.3.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.435% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/woocommerce-mis-report/vulnerability/wordpress-woocommerce-sales-mis-report-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report allows Reflected XSS. This issue affects WooCommerce Sales MIS Report: from n/a through 4.0.3.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report woocommerce-mis-report allows Reflected XSS.This issue affects WooCommerce Sales MIS Report: from n/a through <= 4.0.3.
References	https://patchstack.com/database/wordpress/plugin/woocommerce-mis-report/vulnerability/wordpress-woocommerce-sales-mis-report-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/woocommerce-mis-report/vulnerability/wordpress-woocommerce-sales-mis-report-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 11, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 11, 2025 9:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report allows Reflected XSS. This issue affects WooCommerce Sales MIS Report: from n/a through 4.0.3.
Title		WordPress WooCommerce Sales MIS Report Plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/woocommerce-mis-report/vulnerability/wordpress-woocommerce-sales-mis-report-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`