The flaw is an improper neutralization of input during web page generation in the Direct Checkout Button for WooCommerce plugin, allowing an attacker to store malicious scripts that are executed whenever a visitor loads a page rendered by the plugin. This stored XSS can lead to session hijacking, credential theft, defacement or arbitrary script execution on the client side. The weakness is classified as CWE‑79.

Any WordPress site running the Direct Checkout Button for WooCommerce plugin version 1.0 or older is vulnerable. The vulnerability covers all releases from the plugin’s earliest available version up to and including 1.0. Sites that have installed this plugin alongside WooCommerce and are not upgraded to a later release are susceptible.

The CVSS score of 6.5 reflects moderate overall risk, while an EPSS of less than 1% indicates a very low probability of exploitation in the wild. The issue is not currently listed in the CISA KEV catalog. An attacker can exploit the vulnerability by injecting a crafted input that the plugin stores and later displays, so a successful attack typically requires no special privileges and can affect all users who view the page where the payload is rendered.