The Live Sales Notification for WooCommerce - Woomotiv plugin is vulnerable to reflected cross‑site scripting via the woomotiv_limit parameter. The parameter is not properly sanitized or escaped before being rendered in a page, allowing an unauthenticated attacker to inject arbitrary JavaScript that will run when a user follows a crafted link. Based on the description, the likely attack vector involves an attacker tricking a user into clicking a URL that includes the vulnerable woomotiv_limit value.

All releases of the Live Sales Notification for WooCommerce - Woomotiv plugin dated up to and including version 3.6.3 are affected. The product is a WordPress plugin used by site administrators to display real‑time sales notifications.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not present in the CISA KEV catalog, yet it can be leveraged if an attacker persuades a user to click a malicious link containing the vulnerable woomotiv_limit parameter. Based on the description, the likely attack vector is a phishing‑style link that includes crafted input, requiring the victim to click in order to trigger the reflected XSS.