The Tax Switch for WooCommerce plugin stores user‐supplied code in the database through the class‑name parameter without proper sanitization or escaping, allowing an authenticated attacker with at least Contributor rights to inject arbitrary JavaScript. Once injected, the code executes in the browser context of any user who visits the affected page, enabling attempts at session hijacking, cookie theft, defacement, or phishing. The vulnerability is a classic Cross‑Site Scripting flaw (CWE‑79).

The affected product is the Tax Switch for WooCommerce WordPress plugin by wijnbergdevelopments. All releases up to and including version 1.4.2 are vulnerable; newer versions claim the issue is resolved.

The CVSS base score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires a legitimate WordPress login with at least Contributor privileges and access to the plugin’s class‑name configuration. If an attacker can modify the parameter, they can persist malicious scripts that trigger for any site visitor.