This vulnerability arises from the WowStore plugin’s "filterMobileText" block attribute, which is stored inside a Gutenberg block JSON comment. The plugin sanitizes input with wp_kses_post, but this function does not remove attributes that break out of the JSON context, allowing a malicious script to be stored. When the page is rendered, the block callback outputs the script unescaped and it executes in any visitor’s browser. The effect is that an authenticated contributor can inject arbitrary JavaScript that will run whenever users view the affected page, leading to possible session hijacking, credential theft, defacement, or other typical XSS‑related damage.

The flaw affects the WowStore – Store Builder & Product Blocks for WooCommerce WordPress plugin by wpxpo, in all released versions up to and including 4.4.24. Any WordPress site that has installed this plugin and has contributors with write access is potentially vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests that public exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated contributor or higher to inject the offending payload, which limits the attack surface to sites with accessible contributor roles. Once injected, the malicious script is persisted and will affect all users who view the page, making it a persistent threat. Because the attacker only needs write access and the capability to submit data through the block interface, the risk remains significant in environments where contributor accounts are not properly vetted or monitored.