An improper neutralization of user input during web page generation in the WordPress bidorbuy Store Integrator plugin enables a developer to inject malicious scripts into the page. By crafting a request containing attacker‑controlled data, an unsuspecting visitor’s browser will execute the injected JavaScript in the context of the site. This result can lead to defacement, credential theft, or session hijacking, impacting the confidentiality, integrity, or availability of the site for its users.

The vulnerability exists in the extremeidea bidorbuy Store Integrator plugin for WordPress versions from the earliest available install through 2.12.0. All installations of this plugin that have not applied a newer release are potentially vulnerable. The affected product is the bidorbuy Store Integrator plugin, version 2.12.0 or earlier.

The CVSS score of 7.1 indicates a high‑severity risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is client‑side; an attacker must convince a user to load a malicious URL or link that contains the injected payload, and the exposure remains without prompt remediation.