The plugin outputs text for product stickers without proper escaping, allowing an attacker to embed arbitrary JavaScript that is executed by any visitor viewing the page. This reflected XSS can lead to malicious code running in the victim’s browser in the context of the site.

All releases of Starblank’s Custom Product Stickers for WooCommerce up to and including version 1.9.0 are affected. Sites that have not updated the plugin remain vulnerable.

The CVSS score of 7.1 indicates medium severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. The most likely attack vector is a crafted URL or form input that contains the malicious payload; authentication is not required and the flaw is reflected, meaning an attacker only needs to lure a victim into visiting a URL or submitting a form with injected data to trigger the XSS.