The Checkout Files Upload for WooCommerce plugin stores uploaded images without proper sanitization or escaping. An attacker who can upload a crafted image can embed malicious JavaScript that will be executed when the image—or the page that references it—is viewed by any browser. This flaw enables arbitrary script execution in the context of the site, classifying it as a stored cross‑site scripting vulnerability (CWE-79).

WordPress sites that have the Checkout Files Upload for WooCommerce plugin from wpwham, version 2.2.1 or earlier, are affected. The vulnerability exists solely in the plugin’s handling of file uploads and is independent of the operating system or WordPress core version.

The CVSS score of 7.2 indicates a high‑severity issue, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers need only to upload a malicious image to the public upload endpoint; no authentication is required. If the image is displayed to users, the injected script runs in their browsers, allowing the attacker to execute arbitrary code in the site’s context.