The Dynamic AJAX Product Filters for WooCommerce plugin allows authenticated attackers with Contributor permission or higher to store malicious scripts in the in‑app ‘className’ parameter. The plugin does not sanitize or escape this input, so the embedded code is written directly into the database and executed whenever the page containing the injected data is loaded. This results in classic stored cross‑site scripting that can deface content, harvest session cookies, or redirect users to malicious sites.

The vulnerability affects all installations of the plugincy‑managed Dynamic AJAX Product Filters plugin for WordPress with versions up to and including 1.3.7. Any WordPress site that has installed this plugin and has users with Contributor or higher roles is exposed.

The CVSS score of 6.4 marks the risk as moderate, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate as a Contributor or privileged user; the exploit then requires submitting a payload via the className field, which is stored and then served to any visitor, achieving the cross‑site scripting effect.