The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious script into the plugin’s message content. By submitting specially crafted input through the message interface, the malicious payload is saved and executed whenever any site visitor renders the message. This can lead to session hijacking, cookie theft, data tampering, or defacement of the site’s front‑end.

The affected product is the WPC Smart Messages for WooCommerce plugin developed by WPClever. Versions from n/a up to and including 4.2.8 are vulnerable; the issue is not present in newer releases.

The CVSS score of 6.5 indicates moderate‑to‑high severity. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. It is likely that an attacker would gain access to the plugin’s backend or content creation interface and store the payload, after which any user who loads the page triggers the script. Because execution occurs during page rendering, the attack vector is web‑based and depends on the user’s web browser.