WordPress CVE-2025-59006

We need to generate a JSON with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector.

Given CVE: CVE-2025-59006. Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS. Affects from n/a through <= 1.0.2. CVSS: 7.1, vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS: 0.03% (percentile 8%). Tags: XSS, WordPress. Reference: patchstack. No KEV, no POC mentioned. CWE-79.

Product: Easy Woocommerce Customizer plugin for WordPress. So product_name: "Easy Woocommerce Customizer". Summary: Reflected XSS in the plugin allows unauthenticated attackers to inject malicious scripts via user input reflected on a page, requiring user interaction (clicking a crafted link). Affected versions <=1.0.2. No active exploitation reported, no POC, EPSS low. So summary: "Reflected cross-site scripting in the Easy Woocommerce Customizer WordPress plugin (up to 1.0.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated administrator or other user who clicks a crafted link. Successful exploitation could lead to session hijacking, site defacement, or redirection to malicious sites, but requires user interaction." But need to avoid copying description, be original synthesis. So: "Reflected cross-site scripting vulnerability in the Easy Woocommerce Customizer WordPress plugin (<=1.0.2) enables unauthenticated attackers to inject arbitrary web scripts into pages that are reflected back to the victim. When an administrator or logged-in user clicks a crafted link, the attacker can execute JavaScript in their session, potentially leading to administrative takeover." No active exploitatio