This vulnerability arises from improper neutralization of user input during web page generation. An attacker can embed malicious JavaScript that is stored by the Premmerce Product Search for WooCommerce plugin and subsequently executed whenever a user views a page that renders the stored content, enabling the attacker to hijack sessions, deface a site, or steal credentials.

WordPress sites that have installed any version of the Premmerce Product Search for WooCommerce plugin from the earliest release up to and including version 2.2.5 are impacted. The issue affects all users who can input data that the plugin processes and stores without proper escaping.

The CVSS score of 5.9 classifies the risk as moderate, indicating a potential for moderate impact if an attacker succeeds. The EPSS score of less than 1% suggests that the probability of exploitation is low in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to exploit the web application interface to store malicious payloads, making the attack vector a web‑based one; however, once the payload is stored it is executed in any visitor’s browser without authentication.