The vulnerability exists in the Flash Sale Countdown module of the ShopLentor plugin, allowing an attacker with contributor or higher privileges to inject scripts via a stored DOM‑based XSS flaw. The injected code executes in any user’s browser when visiting the affected page, potentially leading to credential theft, session hijacking, data exfiltration, or defacement. This weakness stems from insufficient input sanitization and output escaping, as identified by CWE‑79.

The affected product is the ShopLentor – All‑in‑One WooCommerce Growth & Store Enhancement Plugin, developed by devitemsllc, which runs on WordPress. All releases up to and including version 3.1.0 are vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Inferred from the description, an attacker must be authenticated as a contributor or higher, access the module editor, and supply malicious input; the malicious script is then stored and subsequently rendered in the page context for any user who views the page.