The vulnerability arises from improper handling of user-supplied data in the WordPress plugin, enabling a DOM‑based cross‑site scripting flaw. An attacker could inject malicious scripts that run in the victim’s browser, allowing cookie theft, session hijacking, or the execution of arbitrary client‑side code. This is a classic input‑validation weakness classified as CWE‑79.

The affected product is ProWCPlugins Related Products Manager for WooCommerce. Versions up to and including 1.6.2 are affected; no more recent versions are listed as vulnerable, so any site using 1.6.2 or older is at risk.

The reported CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests exploitation opportunities are currently rare, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector involves an attacker supplying crafted data to a front‑end parameter that the plugin renders without sanitisation. Successful exploitation requires an authenticated or unauthenticated user to load the affected page, and the impact is confined to the victim’s browser rather than the server. Because of the DOM‑based nature, deploying browser‑side mitigations can reduce risk.