The vulnerability allows attackers to inject arbitrary scripts into pages served by WordPress sites that use the Active Products Tables for WooCommerce plugin. By supplying malicious content in the 'shortcodes_set' parameter, an unauthenticated user can cause an innocent visitor to execute scripts when they view a page containing the shortcode. This result is a classic reflected XSS that can compromise client-side data, facilitate phishing, or provide a foothold for further cookie-stealing attacks.

The flaw affects the WordPress plugin RealMag777’s Active Products Tables for WooCommerce, versions up to and including 1.0.6.6. Targets are sites running any WordPress installation with the plugin installed and the shortcode active. The vulnerability is present in the plugin's source file referenced in the official WordPress repository.

The CVSS score of 6.1 classifies the vulnerability as medium severity, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. Because access requires an unauthenticated user to persuade another visitor to click a crafted link, the attack vector is user interaction – it is not remotely exploitable without human collaboration. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported yet.