The vulnerability is an improper neutralization of input during web page generation that allows a stored Cross‑Site Scripting (XSS) attack in the WordPress Sales Count Manager for WooCommerce plugin. An attacker can inject malicious scripts that are then rendered in the browser of anyone who views the affected content, potentially stealing session cookies, defacing the site, or executing arbitrary client‑side actions. The primary impact is the compromise of confidentiality and integrity of sensitive user data, and depending on the attacker’s intentions, it could also lead to defacement or further exploitation of the site.

Vendors: WP‑EXPERTS․IN: Sales Count Manager for WooCommerce. Affected versions are all releases from the initial release through version 2.6 inclusive.

The CVSS score of 5.9 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates that the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface, where an attacker must be able to submit content that the plugin stores for later display. If the plugin allows administrative users to enter data, an attacker who compromises an admin account—or convinces a legitimate admin to submit malicious data—would be able to exploit this stored XSS flaw.