The Grid/List View for WooCommerce plugin is vulnerable to Stored Cross‑Site Scripting via the 'position' shortcode attribute. Insufficient input sanitization paired with a failure to escape output allows an authenticated user with contributor or higher privileges to store malicious scripts in the widget configuration. Once the widget renders, typically on shop or category pages but capable of being forced to render on any page using the all_page="1" attribute, the injected script runs in the context of any visitor, potentially leaking credentials, defacing content, or executing further payloads.

WordPress sites using the berocket Grid/List View for WooCommerce plugin, all versions up to and including 3.0.9. All users who view a page that renders a widget containing the injected position string are affected; the impact is present even on sites that have not customized the widget settings, as the default rendering can be hijacked.

The CVSS score of 6.4 indicates medium severity, while an EPSS score of less than 1% suggests exploitation opportunities are currently rare. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread evidence of exploitation in the field. Exploitation requires the attacker to be authenticated with contributor-level access or higher and to create or edit a widget that uses the vulnerable 'position' shortcode. Once injected, the payload executes for any visitor who encounters the rendered widget.