The FastSpring WordPress plugin allows authenticated users with contributor‑level or higher rights to inject malicious JavaScript into the "color" attribute of its product catalog block. The input is not sanitized and the output is not escaped, so the attacker can store scripts that run whenever a page containing the block is viewed. The impact is that scripts execute in the context of the site visitor, potentially enabling session hijacking, defacement, or phishing attacks.

The vulnerability affects the FastSpring plugin developed by jtewes, available on WordPress. All releases up to and including 3.0.1 are impacted. It applies to any WordPress site that has this plugin installed and uses the product catalog block.

With a CVSS score of 6.4 the vulnerability presents moderate severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with contributor privileges or higher and must be able to edit pages that use the product catalog block. Once the malicious code is stored it is triggered for any visitor who loads the affected page, giving the attacker a persistence vector. Close monitoring of user activity and contributor permissions is advised while a patch is applied.