The vulnerability arises from improper neutralization of user input in the Upsell Order Bump Offer for WooCommerce plugin. When a request containing malicious payload is processed, the plugin reflects the data back to the web page without sanitizing it, allowing an attacker to inject arbitrary JavaScript. If the victim’s browser executes the injected script, attackers can hijack the session, steal credentials, deface the site, or redirect the user to malicious destinations.

Any WordPress site that has the WP Swings Upsell Order Bump Offer for WooCommerce plugin installed and whose version is 3.1.6 or earlier is affected. This includes all WooCommerce stores that rely on the upsell bump feature without updating the plugin beyond the 3.1.6 release.

The CVSS score of 7.1 marks this as high severity. No EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog, indicating that there are currently no known widespread exploits. The likely attack vector is a victim being tricked into visiting a crafted URL or clicking a malicious link that contains the reflected payload; once the user loads the page, the script runs in their browser, creating the conditions for confidentiality or integrity violations.