The vulnerability occurs when the product_name field in the Stylish Order Form Builder plugin is stored without adequate input sanitization or output encoding, allowing attackers with subscriber‑level privileges to embed malicious scripts. The injected code executes in the context of any user who views the affected page, enabling theft of session cookies, defacement, or further exploitation. This is a classic stored XSS flaw (CWE-79).

This issue affects all releases of the Stylish Order Form Builder plugin by hayyatapps up to and including version 1.0. Versions beyond 1.0 have not been explicitly mentioned as fixed, but may still be impacted if sanitization changes have not been applied. WordPress sites running this plugin at any of these versions are at risk.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that actual exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for only subscriber‑level authentication means that a large portion of site users could perpetrate the attack, increasing the potential impact if compromised credentials exist. Attackers would need to log into the WordPress dashboard, navigate to product management, and submit a crafted product_name string to inject their payload.