The vulnerability is an improper neutralization of input during web page generation, which allows an attacker to inject arbitrary JavaScript that is subsequently saved in the database and executed in the browsers of users who view the affected content. The impact is that a malicious script could steal user credentials, deface the site, or compromise nearby systems through browser-based attack vectors. The weakness is identified as CWE‑79, which denotes a failure to properly validate or encode user-supplied data before rendering it in a web page.

The affected product is RealMag777 BEAR, the WooCommerce Bulk Editor and Products Manager Professional plugin for WordPress. Versions from the initial release up through 1.1.4.4 are impacted, according to the vendor’s version range statement. Any WordPress site installing one of these versions is vulnerable, regardless of the WordPress core or theme version.

The CVSS score of 5.9 indicates a moderate security risk. The EPSS score of less than 1% suggests that the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the plugin’s administrative interface, where an authenticated user can submit data that is not properly sanitized. Although an attacker would need write access to the plugin’s data store, the stored nature of the XSS means that once inserted, the payload can affect any visitor to the site. The modest severity and exploit probability should still prompt immediate patching to eliminate the risk of exploitation.