stored cross‑site scripting is present in the Waitlist Woocommerce plugin due to improper neutralization of user input when generating web pages. The flaw allows an attacker to inject malicious scripts that will execute within the context of any authenticated or unauthenticated user who views a page containing the payload. This can lead to theft of session cookies, defacement, or the execution of arbitrary code on the victim’s browser, compromising confidentiality and integrity of user data.

the vulnerability affects xootix Waitlist Woocommerce (Back in stock notifier) plugin versions up to and including 2.9.1. Any WordPress site deploying these plugin versions is susceptible regardless of other security configurations.

the CVSS score of 6.5 indicates a medium severity risk. EPSS is not available, so the likelihood of exploitation is currently unknown. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been observed in widespread attacks. Attackers would likely exploit it via crafted URLs or form submissions, relying on the fact that the plugin does not filter input for JavaScript before rendering the page.