The WooCommerce – Products By Custom Tax plugin is vulnerable to stored cross‑site scripting through the woo_products_custom_tax shortcode. Input attributes are not properly sanitized or escaped, allowing an authenticated user with contributor‑level access or higher to inject arbitrary JavaScript that is saved to the page and executed whenever any visitor loads the affected content. The description does not detail the specific consequences of the injected script; it only states that the script runs in the context of legitimate users. Based on the description, the attacker must have contributor‑level access or higher to inject the payload.

WordPress sites that have installed the WooCommerce – Products By Custom Tax plugin by the vendor Elvismdev. All plugin versions up to and including 2.2 are affected.

The CVSS score of 6.4 indicates a medium severity exposure. The EPSS score is below 1%, suggesting a low likelihood of mass exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. However, the attack requires an authenticated contributor‑level role; once the payload is stored it will affect all users who view the injected page. Given that the payload can affect all users who view the injected page, administrators should consider this a priority issue.