The Dropify wc‑dropi‑integration plugin has an improper neutralization of user input during page rendering. This flaw allows attackers to inject script into the output, resulting in reflected cross‑site scripting. The vulnerability can be triggered when the plugin processes specific input that is reflected in the rendered page.

The plugin version 4.7.2 or earlier by Jhainey Milevis is affected. Any WordPress installation that includes these plugin versions is vulnerable, regardless of other components.

The CVSS score of 7.1 classifies the issue as moderate to high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, yet it remains a potential threat. The vulnerability is not listed in CISA KEV. Attackers can craft input that the plugin outputs without proper escaping, leading to execution of malicious scripts in the victim’s browser.