This vulnerability allows stored XSS in Ni WooCommerce Cost Of Goods plugin for WordPress, enabling an attacker to inject malicious scripts that are rendered for all visitors. The injected scripts can steal session cookies, deface content, or redirect users to phishing sites, compromising confidentiality and integrity of affected sites and potentially all users visiting them.

WordPress sites using the Ni WooCommerce Cost Of Goods plugin by Anzar Ahmed, in versions from an unspecified earliest release up to and including 3.2.8.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in any CISA KEV catalog. Attackers likely need the ability to submit content to the plugin’s input fields, which may require administrator or product‑edit privileges; however, the stored nature of the flaw means the injected script runs in the browser context of any site visitor, once the malicious content is stored. Based on the description, the attack vector is inferred to be via the plugin’s content submission interface, where user‑supplied data is stored and later rendered.