The StoreGrowth Smart Sales Booster plugin for WooCommerce suffers from a stored cross‑site scripting flaw that lets unauthenticated attackers inject and store arbitrary JavaScript through the message_popup parameter. The vulnerability stems from inadequate input sanitization, missing output escaping, and a nonce that is inadvertently exposed via wp_localize_script, which bypasses the intended access control. When a user loads a page containing the malicious payload, the script runs in their browser, potentially enabling session hijacking, site defacement, or other malicious activities. This is a classic CWE‑79 vulnerability involving unchecked user input.

Affected systems are the WeDevs StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout, and Side Cart plugin for WooCommerce. All releases up to and including version 2.1.0 are affected; newer releases are assumed to contain the fix.

The CVSS score of 7.2 signifies high severity, while an EPSS score of less than 1% indicates low current exploitation probability. Attackers need no credentials, as the vulnerable end‑points are reachable to unauthenticated front‑end visitors and the required nonce is leaked via a localized script. Though not listed in the CISA KEV catalog, the flaw remains a significant risk for sites still running vulnerable plugin versions.