The vulnerability is an improper neutralization of input during web page generation, classified as a stored XSS flaw. An attacker can inject malicious scripts that are saved in the database and executed whenever the affected page is rendered. This can allow an attacker to steal session cookies, deface the site, or perform actions on behalf of legitimate users. The weakness is identified as CWE‑79.

The affected product is the WP Swings Upsell Order Bump Offer for WooCommerce plugin, versions through and including 3.0.7. Users running any of these versions on their WooCommerce sites are susceptible.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is via a stored input field that the plugin accepts; an attacker would need to submit malicious content through that field—which may require administrative access or the ability to add content—after which any site visitor would be exposed to the injected script.