The SpecFit‑Virtual Try On WooCommerce plugin suffers from improper neutralization of input that allows attackers to store malicious scripts in the site. When a user views the affected content, the stored script is rendered, enabling arbitrary JavaScript execution in the browsers of all visitors to the site. This flaw, classified as CWE‑79, can result in session hijacking, defacement, or other malicious actions performed within the victim's environment.

WordPress sites that have the dugudlabs SpecFit‑Virtual Try On WooCommerce plugin installed in any version up to and including 8.0.3 are vulnerable. The issue is present from the earliest releases through 8.0.3; versions 8.0.4 and later are not affected.

The CVSS score of 7.1 indicates a high severity while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector inferred from the description is that an attacker crafts malicious input through a plugin interface that is stored and later rendered. Because the stored payload is executed in any visitor's browser, the impact can be widespread on the site, although the opportunity for exploitation depends on the visibility of the vulnerable interface. The attack can be carried out by users who can submit content via the plugin, and the output is displayed without proper sanitization.