The PDF Catalog for WooCommerce plugin contains a stored XSS flaw in its pdfcatalog AJAX action because user input is neither sanitized nor escaped. An authenticated user with a Subscriber or higher role can inject arbitrary scripts that are stored and later rendered by any visitor to the affected catalog page. The payload runs with the privileges of the page, enabling session hijacking, defacement, or client‑side data theft. This weakness is a classic example of CWE‑79.

All WordPress sites that have the PDF Catalog for WooCommerce plugin installed at version 1.1.18 or earlier are affected. The plugin must be active and the site must have users with Subscriber or higher roles to exploit the flaw.

The base CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. Attackers must first be authenticated, then submit the malicious payload through the forumine 'pdfcatalog' AJAX endpoint. Once stored, any user who views the catalog will execute the injected script in their browser, creating opportunities for client‑side attacks such as cookie theft or phishing.