This flaw is an improper neutralization of input that allows an attacker to store malicious scripts within the Mobile App for WooCommerce plugin. The stored XSS can be executed in the browsers of any site visitor who interacts with the affected component, facilitating session hijacking, data theft, or defacement. The weakness corresponds to CWE-79 and is classified as a stored cross‑site scripting vulnerability.

The vulnerability impacts the weptile Mobile App for WooCommerce plugin, affecting all released versions up to and including 0.4.61.

The CVSS score of 7.1 indicates a high‑severity flaw with potential compromise of confidentiality or integrity. The EPSS score is below 1 %, showing a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw permits injection of persistent scripts via plugin input fields, a remote attacker can exploit it without needing privileged access; this inference is based on the description of stored XSS. An exploit can be achieved by submitting crafted input that the plugin stores unescaped and later renders in a web page, triggering script execution in the context of site users.