This vulnerability arises from improper neutralization of input during web page generation. An attacker can supply malicious script code that is reflected back to the victim’s browser, enabling a Reflected XSS injection. The consequence is that arbitrary client‑side code may run with the privileges of the user viewing the page, potentially allowing session hijacking, defacement, or phishing attacks.

The impacted product is the Store Exporter plugin for WooCommerce developed by Josh Kohlbach. Any installation of the plugin in versions up to and including 2.7.4 is affected.

The CVSS score of 7.1 indicates moderate severity, while an EPSS score of less than 1 % points to a low exploitation probability. The vulnerability is not listed in CISA KEV, so no widespread exploitation has been reported. The likely attack vector is a reflected XSS that can be triggered by a crafted URL or input field, requiring the victim to view a malicious page; once the payload executes, it runs within the victim’s browser context.