The Premmerce plugin for WordPress contains a stored XSS vulnerability triggered through the premmerce_wizard_actions AJAX endpoint. The flaw originates from a lack of capability checks and insufficient input sanitization and output escaping on the state parameter. Authenticated users with subscriber level or higher privileges can inject arbitrary scripts that are persisted on the Premmerce Wizard admin page; any administrator who visits the page will have the malicious code executed.

All ranks of the Premmerce plugin up to and including version 1.3.20 are affected. The issue resides in the admin wizard component of the premmerce:Premmerce product for WordPress. Sites that host this plugin and allow subscriber‑level or higher users to access the wizard are impacted. Updating to a later release that removes the vulnerable endpoint eliminates the flaw.

The CVSS base score of 6.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in recent observations. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to be a logged‑in user with at least subscriber privileges and to interact with the wizard page; it does not grant remote code execution or privilege escalation beyond that role. Consequently, the risk is moderate but limited to sites that keep the legacy plugin and expose the wizard to non‑administrator users.