The plugin contains a stored XSS vulnerability triggered by the xoo_el_action shortcode due to lack of proper input sanitization and output escaping. Authenticated users with contributor-level or higher privileges can inject arbitrary scripts that will execute in the browsers of all users who view the affected page. Such exploitation could lead to defacement, credential theft, or session hijacking, posing a medium severity risk to confidentiality and user experience.

All installations of the WordPress plugin "Login & Register Customizer – Popup | Slider | Inline | WooCommerce" by xootix, versions up to and including 2.8.5. Systems running WordPress with WooCommerce that permit contributor or higher role accounts utilizing this plugin are susceptible; later releases are not known to be vulnerable.

The CVSS base score is 6.4 and the EPSS score is less than 1%, indicating a modest likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because it requires authenticated access, the attack surface is limited to users with contributor or higher roles, but once injected a malicious script will run for any visitor to the page. Overall, administrators should consider this a medium risk that warrants prompt remediation.