The vulnerability is an stored cross‑site scripting flaw caused by insufficient input sanitization in WooCommerce Additional Fees On Checkout (Free). Improper neutralization of input allows an attacker to embed persistent malicious scripts that will run whenever a page containing the affected data is rendered, potentially enabling credential theft, session hijacking, or defacement.

All installations of the plugin developed by WPSuperiors Developer, specifically WooCommerce Additional Fees On Checkout (Free) version 1.5.2 or earlier, are susceptible. Updated or later releases remove the flaw.

With a CVSS score of 5.9 the severity is moderate; the EPSS score of less than 1 % indicates a very low probability of exploitation under current data. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the exploit likely requires access to the input fields used by the plugin during checkout or product configuration, so the attack surface is limited to sites that enable the plugin and allow malicious input.