Improper Neutralization of Input During Web Page Generation creates a DOM‑based XSS vulnerability in the PDF Catalog Woocommerce plugin. A malicious attacker can inject arbitrary JavaScript that executes in the browser of anyone who views the affected page, potentially leading to credential theft, defacement, or other client‑side actions performed in the victim’s session, compromising confidentiality and integrity.

WordPress sites that use the PDF Catalog Woocommerce plugin by theme funda, version 2.0 or earlier.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score below 1 % suggests low likelihood of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely client‑side via crafted URLs or form inputs that the plugin incorporates into page markup; an attacker can supply malicious script that the victim’s browser will execute when the affected page is loaded. No authentication or elevated privileges are required for exploitation.