The WooMS plugin for WordPress contains an improper neutralization of input during web page generation, allowing attackers to embed script or HTML content that is reflected in the browser. This flaw works on all releases of the plugin up to and including version 9.12. While the description does not list specific downstream effects, it is well known that reflected XSS can be used to execute malicious code in the victim’s browser, potentially leading to session hijacking, defacement or phishing. The weakness is classified as CWE‑79.

Any WordPress site that has the WooMS plugin installed in a version 9.12 or earlier is affected. The issue applies to all earlier releases of the plugin back to its first public release.

The vulnerability receives a CVSS score of 7.1, indicating high severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild at the current time. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw remotely by crafting URLs or form submissions that the plugin renders without proper sanitization. Exploitation does not require local or privileged access and can be performed against any publicly reachable WooMS endpoint that reflects user input.