This vulnerability is a stored cross-site scripting flaw wherein user-provided input used by the WPFactory Free Shipping Bar plugin is rendered without proper neutralization. An attacker can insert malicious scripts that are persisted and later executed in the browsers of site visitors, potentially compromising session cookies, defacing content, or exfiltrating data. The weakness is classified as CWE-79.

The weakness affects the WPFactory Free Shipping Bar plugin for WordPress, specifically all releases from the initial version through and including 2.4.6. Site administrators using these versions are at risk when they allow any form of input that feeds the plugin’s display mechanism.

The CVSS score of 6.5 indicates a moderate severity. The EPSS < 1% shows a very low but nonzero probability of exploitation in the wild, and the vulnerability is not in CISA’s KEV catalog. Attackers would most likely target sites by gaining access to the WordPress administration panel to inject malicious payloads via the plugin’s settings or content fields; the stored nature of the flaw means the malicious code persists until it is removed or the plugin is updated.