The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input during page generation. An attacker can inject malicious scripts into coupon or add‑to‑cart links, which are then displayed to any visitor of the affected WordPress site. This can lead to credential theft, session hijacking, defacement or delivery of further malware, affecting the confidentiality, integrity and availability of the site and its users.

WPFactory Coupons & Add to Cart by URL Links for WooCommerce on WordPress sites, all released versions up to and including 1.7.7 are vulnerable. No version is listed as a fix, indicating that all current builds carry the flaw.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s URL link interface, where a malicious user creates or modifies a coupon link with embedded script code. Successful exploitation would give an attacker the same permissions as the site visitor that loads the page.