The Ebook Store plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because the Order Details field is not properly sanitized or escaped. If an authenticated user with administrator privileges injects malicious JavaScript into this field, the script will run in the browser whenever anyone views the affected page, allowing the attacker to deface content, steal session cookies or perform other client‑side attacks.

The vulnerability affects installations of the Motovnet Ebook Store plugin version 5.8012 and earlier. It is limited to multi‑site WordPress environments where the unfiltered_html capability is disabled, meaning only administrators who can add unrestricted HTML are able to inject the payload.

With a CVSS score of 4.4 the risk is considered moderate. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires administrator credentials to inject the script; no remote code execution or privilege escalation is possible. Once injected, the malicious code will execute for every visitor who accesses the order details page, potentially compromising their sessions or facilitating phishing attacks.