The Magical Products Display plugin (WordPress) contains a stored cross‑site scripting flaw in the MPD Pricing Table widget. When a contributor‑level user edits the widget, the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters are not sanitized or escaped, allowing arbitrary HTML tags and embedded scripts to be stored. Any site visitor who accesses a page containing the run the injected script in their browser, enabling data theft, defacement or credential compromise.

All installations of Magical Products Display plugin for WordPress through version 1.1.29 are affected. The vulnerability applies to the plugin’s pricing table widget that can be activated on product, shop, or checkout pages via the WooCommerce Elementor template builder.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests low exploitation probability. The attack requires an authenticated user with Contributor or higher privileges, limiting the threat surface. However, once the contributor role is compromised, the injected script can affect every site visitor, extracting cookies or performing phishing operations. The vulnerability is not currently listed in the CISA KEV catalog.