The vulnerability is an improper neutralization of user input during web page generation that allows stored Cross‑Site Scripting (XSS). An attacker can insert malicious scripts that persistently execute when vulnerable content is displayed, potentially stealing session cookies, hijacking accounts, or modifying page content for malicious ends. The weakness is identified as CWE‑79.

Any WordPress site using the WP Wham Checkout Files Upload for WooCommerce plugin version 2.2.0 or earlier is affected. The plugin on its checkout or file upload pages is vulnerable; no other WordPress products are listed as impacted.

With a CVSS score of 6.5, the vulnerability is classified as moderate severity. Its EPSS score of less than 1% indicates a very low probability of exploitation at present, and it is not listed in the CISA KEV catalog. An attacker can exploit the flaw by uploading a file containing JavaScript via the plugin’s file upload interface; when a user later views or downloads the file, the malicious script executes in the user’s browser. No additional authentication or privileged access is required beyond normal site use.