The Dynamic AJAX Product Filters for WooCommerce plugin is vulnerable to Stored Cross‑Site Scripting because the ‘name’ parameter is not correctly sanitized or escaped in all current releases up to 1.3.7. An attacker with Contributor or higher privileges can submit a malicious script that will be stored in the database and later executed whenever a user loads a page that displays the injected filter name. This flaw allows the attacker to carry out typical XSS attacks such as session hijacking, cookie theft, defacement, or the injection of additional malicious payloads.

WordPress sites that have installed the Dynamic AJAX Product Filters for WooCommerce plugin, versions 1.3.7 and earlier. The attacker must possess at least Contributor access to the WordPress administrator interface to inject the payload.

The CVSS score of 6.4 signals a moderate severity, while the EPSS score of below 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Exploitation requires authentication, limiting the available attack surface to authenticated users with Contributor‑level permissions. However, once injected, the script runs in the context of all users who view the affected page, enabling the range of classic XSS consequences.