A stored cross‑site scripting flaw in the WPBean WPB Quick View for WooCommerce plugin results from the plugin’s failure to neutralize user input when generating web pages. Attackers can embed malicious JavaScript that will execute in the browsers of visitors to affected pages, potentially stealing session cookies, redirecting users to malicious sites, or distributing malware, thereby compromising confidentiality and integrity, which is a classic CWE‑79 weakness.

The vulnerability affects the WPBean WPB Quick View for WooCommerce product for any release from its earliest known version through version 2.1.8 inclusive; no later versions are mentioned in the advisory, and no specific fixed version number is provided.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of < 1% suggests a very low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Although the advisory does not detail an exact attack path, it is inferred that the flaw can be exploited through the plugin’s data entry interfaces that persist user input, such as options or product description fields, which are subsequently rendered without adequate escaping.