The WordPress Music Store eCommerce plugin fails to properly neutralize user input before rendering it on a web page, creating a reflected XSS flaw. This vulnerability allows an attacker to embed and execute arbitrary script code in the browser of any user who views a crafted page or submits malicious content. The script runs with the visitor’s browser privileges, which can compromise confidentiality and integrity of the affected WordPress site.

The plugin "Music Store" from codepeople is affected for all releases from the initial version (no specific lower bound) up to and including version 1.1.19. No version later than 1.1.19 is impacted.

The CVSS score of 7.1 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a reflected input parameter that the plugin echoes back; an attacker can embed a malicious script in a URL or form submission that a victim must unknowingly view or submit, without requiring authentication or elevated privileges.