The Simple Excel Pricelist for WooCommerce plugin has a stored cross‑site scripting flaw that allows an authenticated Contributor or higher to insert malicious scripts into pages using the ‘pricelist’ shortcode. Because the plugin does not sanitize or escape user supplied attributes, the attacker’s input can be stored and executed in the context of any user who views a page containing the shortcode. Since the vulnerability only requires the attacker to have at least Contributor permissions and to edit or create posts, it does not rely on external network access. Based on the description, it is inferred that the injected JavaScript could be used for session hijacking, credential theft, or defacement, patterns typical of XSS exploits.

All WordPress sites that install the Simple Excel Pricelist for WooCommerce plugin from prawas, version 1.13 or earlier, are affected. The issue appears in every release up to and including 1.13, regardless of other site configuration or plugins.

The CVSS base score of 6.4 indicates moderate severity and the EPSS score of less than 1 % shows that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to possess at least Contributor level access to edit content and to craft the malicious shortcode payload; once the payload is stored, it will execute for every visitor to the affected page. The likely attack vector is via the ‘pricelist’ shortcode embedded in post content.