The vulnerability is an improper neutralization of user input, allowing an attacker to embed malicious scripts that are stored and later rendered by the WooCommerce plugin. An attacker can craft payloads that persist in the shop’s database and execute when customers view affected pages, leading to session hijacking, credential theft, or defacement. The weakness is classified as CWE‑79, a common insecure input handling flaw.

Automattic’s WooCommerce plugin versions through 10.0.2 are vulnerable. All installations using any release <=10.0.2, regardless of site configuration, are susceptible until a patched version is applied.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% reflects a very low projected exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild. The likely attack vector is user‑generated content—product titles, descriptions, or custom fields—that an attacker can manipulate to inject script payloads which are then stored and served to other users.