The SKU Generator for WooCommerce plugin fails to properly neutralize user input before reflecting it in an HTML response, creating a Cross‑Site Scripting (XSS) vulnerability. An attacker can embed malicious JavaScript in a crafted URL that, when visited by a user, will execute in the victim’s browser, potentially allowing cookie theft, session hijacking, or arbitrary actions on behalf of the user.

WordPress sites that use the WP Wham SKU Generator for WooCommerce plugin, version 1.6.2 or earlier. The vulnerability is limited to this plugin and affects any WordPress deployment that includes it in a WooCommerce environment.

The CVSS score of 7.1 indicates moderate severity, yet the EPSS score of less than 1% signals very low probability of exploitation at the time of analysis. The exploit requires an attacker to craft a malicious URL that a victim visits, so it is a remote user‑initiated attack that does not require authentication. The vulnerability is not listed in CISA KEV catalog, indicating no widespread known exploitation. However, potential impact on user privacy and site integrity makes remediation advisable.