The WordPress plugin WPFactory MSRP (RRP) Pricing for WooCommerce contains a reflected cross‑site scripting flaw that can be triggered when user input is improperly escaped in the generated web page. Attackers can supply a crafted payload via GET parameters or form inputs that will be reflected back to the victim’s browser, potentially enabling the execution of malicious JavaScript. The vulnerability is rated with a CVSS score of 7.1, indicating moderate to high severity.

The flaw affects installations of the MSRP (RRP) Pricing for WooCommerce plugin version 1.8.1 and earlier. Systems running any of those plugin versions—regardless of the WordPress core or WooCommerce version—are potentially vulnerable.

Although the EPSS score is less than 1%, signaling a low probability of exploitation in the wild, the flaw is not listed in the CISA KEV catalog. The attack vector is indirect but accessible: any user who can be made to visit a maliciously crafted URL or submit a form will trigger the reflected payload. If exploited, the attacker can steal cookies, hijack sessions, or deface the site. The impact is confined to the victim’s browser, but the flaw can be abused for phishing or data exfiltration.