The Advanced Customized Prompts WordPress plugin through version 1.0.1 allows any authenticated user such as a subscriber to inject JavaScript into the product popup configuration without performing a capability check or escaping the stored visitors, the injected script executes in the visitor’s browser, enabling attackers to steal session cookies, deface the site, or perform other malicious actions against customers. This vulnerability is a classic stored cross‑site scripting flaw.

WordPress installations that have the Advanced Customized Prompts plugin of version 1.0.1 or earlier installed are affected. The issue occurs when an authorized subscriber creates or edits a product popup configuration using that plugin.

The EPSS score is 0.00158, indicating a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the high impact of stored XSS indicates that exploitation is feasible once an authenticated user has access to the plugin’s configuration interface. An attacker who can log into the site as a subscriber can store malicious JavaScript that is then executed automatically for any visitor viewing the product, making the attack vector an authenticated exploitation of the WordPress back‑end followed by. The CVSS score of 5.4 indicates moderate severity due to the potential for widespread browser compromise.