The Recently Purchased Products For Woo WordPress plugin is affected by stored Cross‑Site Scripting because the view parameter is not properly sanitized or escaped. This weakness (CWE‑79) allows an attacker who can supply the view parameter to store malicious scripts that are rendered whenever a visitor loads the affected page. The vulnerability grants the ability to execute arbitrary client‑side code, potentially affecting the user experience and providing a foothold for other attacks that rely on scripted payloads.

WordPress sites that have installed the Recently Purchased Products For Woo plugin from the vendor worldweb, in any version up to and including 1.1.3. The flaw is independent of the WordPress core version and can be triggered on any user who has Contributor or higher access to the site.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low current chance of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks. The likely attack vector requires the attacker to authenticate with a Contributor or higher role and supply a crafted view parameter in a request that the plugin stores; the stored payload is then served to all site visitors who view the affected page.