Improper neutralization of user input during web page generation allows stored cross‑site scripting in the Get Bowtied Shopkeeper Extender plugin. The flaw lets an attacker embed malicious script code that is rendered in browsers for all visitors, potentially compromising credentials, enabling session hijacking, or defacing content. This is a classic input‑validation weakness classified as CWE‑79 and affects the confidentiality and integrity of site users.

WordPress sites running the Shopkeeper Extender plugin version below 7.0 are vulnerable. All releases from the first available version up through the last minor release before 7.0 are affected. Site administrators should identify any installation of the plugin that has not yet been upgraded.

With a CVSS score of 6.5 the vulnerability carries a moderate severity, but the EPSS score is below 1 % and it is not listed in the CISA KEV catalogue, indicating a low current exploitation probability. The stored nature of the XSS means that any user who visits a page that includes plugin‑generated content will be exposed to the injected script. An attacker would need to inject malicious content into a writable field that the plugin persists, such as a custom option or widget. Once stored, the script runs in the context of all visitors, making the attack vector a web‑application one. Although exploitation likelihood is low, the potential impact warrants proactive remediation.