The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious script into the checkout page of a WooCommerce site that uses the WP Wham Checkout Files Upload for WooCommerce plugin. Because the plugin fails to properly neutralize user input during page generation, a payload delivered through the file upload or related interface can persist and execute in the browsers of any user that views the affected page. This can lead to session hijacking, defacement, or arbitrary code execution in the context of the site’s domain.

The affected product is the WP Wham Checkout Files Upload for WooCommerce plugin, versions from the initial release up to and including 2.4.0. Users running these versions are vulnerable; the issue does not affect newer releases such as 2.4.1 and later.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so exploitation probability cannot be quantified from that metric. The vulnerability is not listed in the CISA KEV catalog, suggesting no broadly known public exploits yet. The most likely attack vector involves obtaining access to the plugin’s upload interface—most commonly granted to site administrators or users with the appropriate capability. An attacker can upload a malicious file or otherwise inject a payload that is then stored and rendered on the checkout page, where it will execute in the browser of any visitor. Its impact is tied to the attacker’s ability to target users who see the affected page, potentially compromising sensitive data or enabling further attacks.