The vulnerability permits stored cross‑site scripting, meaning that malicious code can be permanently embedded in a page served to any visitor. A compromised site could be used to steal session cookies, deface content, or redirect users to malicious domains. The weakness is a classic input‑validation flaw (CWE‑79).

The affected product is the WordPress plugin Quantities and Units for WooCommerce, version 1.0.13 and earlier. The vendor is Nick Verwymeren. No additional version details are provided beyond the upper bound of 1.0.13.

The CVSS score is 6.5, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious payload via the plugin’s input fields, which is stored and later rendered in page output without proper escaping. The primary attack vector is likely within the WordPress admin interface or any user input accepted by the plugin. Nonetheless, because the script runs in the context of site visitors, it can be leveraged to compromise user accounts and hijack sessions.