The YITH WooCommerce Compare plugin for WordPress contains an improper neutralization of input during page generation that permits stored cross‑site scripting. The flaw allows malicious JavaScript to be persisted in the plugin’s database and then echoed unescaped when a product comparison page is rendered, giving an attacker the ability to run code within the victim’s browser session. Because the vulnerability is stored, it can affect all users who view a product that includes the injected payload.

The vulnerability impacts WordPress sites that have the YITH WooCommerce Compare plugin installed in a version through 3.15.0. This includes any WordPress installation, regardless of operating system, because the plugin operates under the CMS’s PHP environment and renders HTML pages.

The CVSS score of 6.5 signals moderate severity, while the EPSS score of less than 1% indicates a low but non‑zero chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can inject a crafted payload via the comparison interface; the plugin then stores this payload and outputs it without proper escaping. Any user who visits the affected comparison page after the payload has been stored may have the malicious JavaScript executed in their browser.