The vulnerability is a stored cross‑site scripting flaw in the wooboigpost_shipping_status shortcode of the Big Post Shipping for WooCommerce plugin. Insufficient input sanitization and output escaping allow authenticated users with contributor level or higher to inject arbitrary scripts via the shortcode’s attributes. When a page containing the shortcode is rendered, the injected scripts execute in the browsers of any user who views that page, potentially enabling credential theft, session hijacking, defacement, or other malicious actions.

All WordPress sites running the Big Post Shipping for WooCommerce plugin from fusedsoftware version 2.1.2 or earlier are affected. The flaw resides in the plugin’s shortcode implementation and is unrelated to the core WordPress software. Sites that have upgraded past version 2.1.2 or that never installed the plugin are not impacted.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and the required attack vector is authenticated; an attacker must possess a contributor‑level or higher account, reducing the overall threat compared to publicly exploitable flaws.