The YITH WooCommerce Quick View WordPress plugin contains a stored cross‑site scripting flaw that allows an attacker with contributor or higher privileges to inject arbitrary JavaScript through attributes of the yith_quick_view shortcode. Once injected, the script executes for any user who views the affected page, potentially enabling script‑based attacks such as session hijacking, defacement, or malicious navigation. This weakness is identified as CWE‑79 and arises from insufficient input sanitization and output escaping during processing of the shortcode attributes.

The vulnerability affects all releases of the YITH WooCommerce Quick View plugin up to and including version 2.7.0. Administrators of WordPress sites that have installed this plugin should verify the installed version and determine whether a newer release is available.

With a CVSS score of 6.4 the flaw represents a moderate severity vulnerability and an EPSS score of less than 1% indicates that exploitation is expected to be rare. The attacker must already be authenticated at a contributor level or higher, and the attack likely originates from the plugin’s front‑end or administration interfaces where the shortcode can be inserted. The vulnerability is not listed in the CISA KEV catalog but the potential impact of cross‑site script execution warrants timely remediation.