The vulnerability is a stored cross‑site scripting flaw caused by improper sanitization of user input in the Product Carousel For WooCommerce – WoorouSell plugin. An attacker who can insert data into a stored field could cause arbitrary JavaScript to execute in the browsers of any users who view the affected page, potentially leading to session hijacking, data theft, or defacement. This weakness is classified as CWE‑79.

The plugin Product Carousel For WooCommerce – WoorouSell from vendor mojofywp is affected. All releases from n/a through version 1.1.0 are vulnerable, including the 1.1.0 release.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests the probability of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves submitting malicious content through the plugin’s administrative or configuration interface, which then gets rendered to visitors without proper escaping. An attacker does not need elevated privileges beyond control of a form that the plugin processes.