Improper neutralization of input during web page generation allows DOM‑Based XSS in the SilkyPress Multi‑Step Checkout for WooCommerce plugin. The vulnerability can be triggered when a user visits a crafted URL or user‑controlled data is inserted into the page. Attacker‑controlled script can execute in the victim’s browser, enabling data theft, session hijacking, or further web‑based attacks.

WordPress installations running SilkyPress Multi‑Step Checkout for WooCommerce version 2.33 or earlier. The plugin renders checkout pages and includes user input that is not properly sanitized before being incorporated into the HTML.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require a victim to visit a page containing malicious data or a link that triggers the DOM‑based XSS, typically via social‑engineering or compromised site content. Proper sanitization or an update is needed to mitigate the risk.