The vulnerability in the Product Subtitle for WooCommerce plugin allows an authenticated user with Contributor or higher permissions to inject arbitrary JavaScript through the ‘htmlTag’ parameter. This flaw arises from insufficient input validation and output escaping. When an attacker submits malicious input, it becomes permanently stored and executed for any site visitor who views the affected content, leading to cookie theft, session hijacking, or defacement of the site’s pages. The weakness is identified as CWE‑79, a classic client‑side injection flaw.

The affected product is the WordPress plugin "Product Subtitle for WooCommerce" supplied by Spiderware, in all releases up to and including version 1.3.9. No specific WordPress core versions are listed, and the vendor’s affected‑version table is not public, so the risk applies to any site running any version of the plugin older than 1.4.0 if such a version exists.

The CVSS score of 6.4 indicates a medium severity for a stored XSS that requires authentication. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog, implying no known widespread exploitation. The attack vector is inferred to be authenticated via the plugin’s administrative interface, where a Contributor can edit subtitle fields. Successful exploitation would compromise any user that visits the page containing the injected script, providing the attacker with the ability to execute arbitrary client‑side code in the victim’s browser.