The vulnerability exists in the Menu Cart for WooCommerce WordPress plugin before version 3.2.1, where cart item variation data is not properly sanitised or escaped before being rendered in the cart slide‑out. This allows an unauthenticated user to inject a malicious script that is stored and later executed in another user’s browser session, including the sessions of administrators. The flaw enables the execution of arbitrary client‑side code, potentially compromising the confidentiality, integrity, or availability of the site’s front‑end.

Any WordPress installation running the Menu Cart for WooCommerce plugin with a version earlier than 3.2.1 is affected. No specific WordPress core version is required for the flaw but the plugin must be installed.

The vulnerability can be exploited by any external user who can add items to the cart and supply variation data. Because the payload is stored, the attack is persistent and will affect all subsequent users who see the compromised cart. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited current exploitation data. Nevertheless, the lack of input sanitisation combined with the ability to affect logged‑in administrators makes the risk significant enough to warrant immediate remediation.