An attacker who has Contributor-level or higher access can exploit the Crowdfunding for WooCommerce plugin by inserting malicious JavaScript into the width parameter used for the progress bar shortcode. Because the plugin does not sanitize or escape this input, the script is stored in the database and appears on the page every time the shortcode is rendered, allowing the attacker to execute code in the context of any site visitor.

WordPress sites that use the Crowdfunding for WooCommerce plugin version 3.1.14 or earlier are vulnerable. The plugin, provided by the wpwham vendor, offers a progress bar shortcode that is enabled when contributors or higher edit or create commission listings. Any user with Contributor or higher role who can edit shortcodes can introduce the malicious payload.

CVSS score 6.4 indicates medium severity, and the EPSS score of less than 1 % suggests that large‑scale exploitation is currently uncommon. The flaw requires authenticated Contributor-level access or higher, so the attack vector is internal. Because the injected script is stored and executed for every user who views the page, a single compromised shortcode can affect all visitors. The vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the potential for cross‑site scripting warrants prompt remediation.