This vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into pages generated by the Ecwid Shopping Cart plugin. The malicious code is executed in the browsers of users who view the affected content, enabling attackers to hijack sessions, steal cookies, deface sites, or distribute malware. The weakness is categorized as CWE‑79, which represents insecure handling of user input in web applications.

The Ecwid Shopping Cart plugin from Lightspeed Ecommerce (Ecwid by Lightspeed) is affected for all versions from the earliest available release through version 7.0 inclusive. Administrators using any of these versions should verify their plugin version and upgrade if possible.

The CVSS score of 6.5 indicates a moderate severity; the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA's KEV catalog. Likely exploitation would involve a malicious actor injecting persistent script through a form or comment field in the plugin, which then surfaces in pages viewed by other users. No privilege escalation or remote code execution is described, so the risk is confined to client‑side impact.