A stored cross‑site scripting flaw exists in WPFactory’s Additional Custom Product Tabs for WooCommerce – the plugin fails to neutralize user input that is rendered in product pages. An attacker who can inject crafted content into a product tab can cause that script to run in the browsers of any site visitor, potentially leading to session hijacking, defacement, or disclosure of sensitive data. The weakness is a classic CWE‑79 type input validation failure.

WPFactory’s Additional Custom Product Tabs for WooCommerce plugin, versions from the earliest release through 1.7.0, is vulnerable. Any WordPress site using these versions of the plugin is at risk.

The CVSS score of 6.5 places the vulnerability in the medium severity range, while an EPSS score of <1% indicates a low likelihood of exploitation at the time of analysis and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw via the plugin’s interface for adding or editing product tabs, so site administrators with sufficient privileges are required to craft the malicious input. Given its stored‑XSS nature, once injected the payload executes for all users, making it a potentially widespread impact for affected sites.