The vulnerability is a stored cross‑site scripting flaw (CWE‑79) in the WPFactory Additional Custom Emails & Recipients for WooCommerce plugin, allowing malicious script injection into stored email templates. An attacker can exploit this to inject scripts that execute in the context of the site’s web pages or email rendering, which can compromise user sessions, deface the site, or steal data from users who view the affected pages.

This flaw affects the WPFactory Additional Custom Emails & Recipients for WooCommerce plugin for WordPress, all versions up to and including 3.5.1. The product is widely used to send custom emails in WooCommerce stores.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is less than 1 %, showing a very low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s email template editing interface, which requires authenticated access. An attacker who can add or modify an email template with malicious content can embed JavaScript that will run when the email is rendered or displayed through the WooCommerce admin UI, potentially impacting any user who opens that page.