Improper neutralization of user input allows stored cross‑site scripting (XSS) in the Cost of Goods for WooCommerce plugin. Because the vulnerability is a CWE‑79 stored XSS, an attacker can inject malicious script that will run in the browser of any user who views a page displaying the affected data, potentially enabling cookie theft, session hijacking, or defacement. While the description does not state a privilege requirement, the lack of authentication details suggests that any user able to submit data to the affected fields could exploit the flaw.

WPFactory’s Cost of Goods for WooCommerce plugin is vulnerable in all releases up to and including version 3.7.0. The affected product is the WordPress plugin that manages product cost information for WooCommerce stores.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, implying a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation has been documented. The likely attack vector involves submitting malicious payloads through any input field that stores data, which is later rendered without proper escaping. An attacker could thus compromise user session data or alter the site’s appearance.