The vulnerability is a Stored Cross‑Site Scripting flaw in the Persian WooCommerce Shipping plugin by Mahdi Yousefi. Untrusted data supplied via plugin controls is rendered unsanitized in generated web pages, allowing an attacker to inject and persist malicious scripts. If an attacker successfully stores payloads, any user who later views the affected content could have their session hijacked, credentials stolen, or the site defaced. The weakness corresponds to CWE‑79.

WordPress sites utilizing the Persian WooCommerce Shipping plugin from Mahdi Yousefi (listed as MahdiY) are affected when running any version up to and including 4.2.3. No other plugins or WordPress core versions are listed. Site administrators should verify the installed version and confront any instances of the plugin.

The CVSS score of 6.5 marks the flaw as moderate severity. The EPSS indicates a very low likelihood of exploitation (<1%). The vulnerability is not present in CISA KEV, suggesting no known widespread active exploitation. Attacks would require an attacker to insert malicious payloads through the plugin's input mechanisms, which may be accessible to administrators or potentially exposed to privileged users. Once stored, the payload can execute in the context of any visitor who views the affected content.