The WOOF Products Filter plugin for WooCommerce version 1.2.3 contains a persistent cross‑site scripting flaw that lets authenticated administrators insert JavaScript into plugin text fields such as ‘Text for block toggle’ and ‘Custom front css styles’. Those injected scripts are stored in the database and rendered on every front‑end page, exposing each visitor to malicious payloads that can steal credentials, hijack sessions, deface the site, or execute arbitrary client‑side code.

Only HUSKY: Products Filter Professional for WooCommerce version 1.2.3, distributed under the pluginus framework, is affected. WordPress sites that have installed this exact release and grant logged‑in users access to the plugin’s design tab are vulnerable; earlier or later releases have not been identified as impacted.

With a CVSS score of 4.8 the vulnerability is classified as moderate. EPSS information is not available, so the likelihood of exploitation cannot be precisely quantified. The flaw requires an authenticated user with permission to edit the design interface; once that prerequisite is met, the attacker can store a payload that will execute for every site visitor. External actors cannot exploit the flaw without first gaining admin credentials, but sites with weak or overly permissive admin accounts are at risk.