Improper neutralization of input in the WPFactory Change Add to Cart Button Text for WooCommerce plugin allows stored script injection. Users who view any page containing the customized cart button may unknowingly execute attacker‑supplied JavaScript, enabling cookie theft, session hijacking, or other malicious client‑side actions. The weakness stems from a classic input validation flaw (CWE‑79).

The vulnerability affects the WPFactory Change Add to Cart Button Text for WooCommerce plugin in versions 2.2.2 and earlier. Site administrators using these releases are susceptible, regardless of the underlying platform or operating system.

The CVSS score of 6.5 indicates a moderate baseline risk, while the EPSS score of less than 1% suggests that large‑scale exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker likely injects malicious code through the plugin’s label field during administration; if an attacker can access the settings page, the stored input poses a direct risk to all site visitors. Organizations should treat this as a reasonable threat that warrants corrective action even if active exploitation is presently rare.