The issue is an improper neutralization of input during web page generation that allows a stored cross‑site scripting (XSS) flaw to be exploited. Any malicious script injected through the plugin’s input handling can subsequently run in the browsers of visitors to the affected site, potentially leading to session hijacking, defacement, or data theft.

The vulnerability affects the WPFactory Wishlist for WooCommerce plugin for all releases up to and including version 3.3.0. Users running any of those versions are impacted, while installations of newer releases are presumed unaffected.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is below 1 %, signalling a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The most likely attack vector is remote via the public web interface, where an attacker can submit malicious payloads that are later rendered during page generation. Because it is a stored XSS flaw, the impact can persist until mitigated.