This vulnerability allows attackers who have shop manager or higher privileges in WordPress to inject malicious scripts into pages via the type field in the Product Addons plugin. The injection is stored, meaning the code persists across sessions and is executed for any user who views the affected page, leading to execution of arbitrary client‑side code. The weakness is a classic stored XSS flaw (CWE‑79).

WordPress users running the Product Addons for WooCommerce – Product Options with Custom Fields plugin, version 3.1.8 or older. No specific product variants or sub‑versions are listed beyond the major release. All users who can manage shop content are potentially affected.

The CVSS score of 4.4 indicates a moderate severity; the vulnerability requires authenticated access but grants no direct system compromise. Because the exploit depends on legitimate shop‑manager credentials, it is less likely to be widely automated, and no EPSS or KEV data suggests high exploitation probability. The attacker’s goal is to subvert end‑user browsers with XSS payloads, which could result in session hijacking, defacement, or theft of customer data. It is recommended to treat this safely given the confirmed injection surface and the potential damage to visitor trust.