This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, allowing stored Cross‑Site Scripting (CWE‑79). When a malicious payload is injected into store data, it is rendered without sanitization, enabling attackers to run arbitrary JavaScript in the context of a visitor’s session.

The affected product is the Automattic WooCommerce plugin, for all releases from the earliest available version through version 9.7.0. Users running any of these versions are potentially vulnerable.

The CVSS score of 5.9 classifies this risk as moderate and the EPSS score of < 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker with the ability to submit product or post data—such as an administrator or a user with content‑editing privileges—injecting malicious code that becomes stored and executed when a visitor views the affected page.