The vulnerability is a Cross‑Site Request Forgery flaw that lets an attacker inject malicious JavaScript into the plugin’s cart notice fields, enabling stored cross‑site scripting. Classified as CWE‑352, it has a CVSS score of 7.1, indicating high potential impact if exploited, but the EPSS score is less than 1% and it is not listed in CISA’s KEV catalog.

All installations of the WordPress plugin Conditional Cart Messages for WooCommerce – YourPlugins.com running version 1.2.10 or earlier are affected. The earliest release up to 1.2.10 contains the flaw, and only upgrading past that version removes the vulnerability.

Exploitation requires an attacker to convince a logged‑in user, preferably an administrator or shop owner, to submit a crafted POST request to the cart notice endpoint without a valid nonce. Once the malicious script is stored, it will execute in the browsers of all visitors, providing persistent client‑side code execution. While recorded exploitation attempts are rare (EPSS < 1%) and it is not currently a known exploited vulnerability, the high CVSS score and the persistence of the stored XSS make it a serious threat.