The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of input during web page generation. Attackers can inject arbitrary script payloads that are stored and later rendered to visitors, enabling malicious actions such as defacement or theft of information if users execute the script. The weakness is classed as CWE‑79 and is evaluated as high severity (CVSS 7.1).

The flaw affects the WordPress WooCommerce Pricing – Product Pricing plugin from Totalsoft. All releases from the first version through and including 1.0.9 are vulnerable. Site administrators using any of these plugin versions are exposed.

The CVSS score of 7.1 reflects a high‑severity stored XSS vulnerability, while the EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploits are known. The attack requires the ability to store malicious content that is later displayed to users; the exact path (e.g., administrative interface, user‑generated content) is not specified in the CVE data, so its presence is inferred from the stored‑XSS nature of the flaw.