Improper neutralization of input during web page generation allows an attacker to inject arbitrary JavaScript into the Sitewide Discount for WooCommerce settings. The resulting stored XSS can lead to session hijacking, defacement, or the execution of malicious payloads in the context of site visitors. The weakness is classified as CWE‑79 and presents a moderate severity risk.

WPFactory’s Sitewide Discount for WooCommerce: Apply Discount to All Products plugin, versions up to and including 2.2.1. All installations relying on this plugin before the 2.2.2 release are potentially vulnerable.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely target sites with the affected plugin through an account with administrative privileges to inject malicious code, which then persists and is served to all site visitors.