The WooCommerce plugin for WordPress contains a deficiency in how it handles data sent via the PostMessage API on the ‘customize‑store’ page. This oversight creates a scenario where an attacker can embed arbitrary JavaScript code that will execute when a victim interacts with the page, such as by clicking a crafted link. The flaw permits the injection of malicious scripts without needing any special authentication, thereby enabling attacks that could compromise user sessions, steal credentials, or deface content. The weakness aligns with the input validation and output escaping failure classified by CWE‑79.

The vulnerability affects installations of the WooCommerce plugin from Automattic for all versions up to and including 9.4.2. Users running the older free WordPress version or any derivative that embeds the same plugin are also at risk until they upgrade to a patched release. No specific operating system or server configuration is required beyond the presence of the affected plugin.

The CVSS score of 6.1 indicates a moderate severity. An EPSS score of 2% suggests that while exploitation is possible, it is not widely observed or expected to occur at high frequency. The vulnerability is not yet listed in the CISA KEV catalog, so it has not been reported as a known exploited vulnerability. Attackers can exploit the flaw by persuading a legitimate user to visit a page with malicious PostMessage data, which is then executed client‑side. The required conditions are minimal: an accessible WooCommerce ‘customize‑store’ page and a user’s browser that processes postmessages.