The WowStore – Store Builder & Product Blocks for WooCommerce plugin allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript into the 'currentPostId' block attribute; the stored cross‑site scripting flaw enables malicious scripts to run automatically whenever a page containing the compromised block is viewed, potentially stealing user session data, defacing content, or executing further attacks against site visitors. This vulnerability is rooted in insufficient sanitization and output escaping and falls under CWE‑79.

All versions of the WowStore plugin up to and including 4.4.24 on WordPress sites are affected, regardless of the WordPress version or theme, as the flaw resides in the plugin’s block handling code.

The CVSS score of 6.4 signals moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of this report. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires an authenticated user with contributor or higher privileges; once injected, the malicious script will execute for every visitor to the affected page, impacting confidentiality and integrity for all front‑end users but not providing direct back‑door access to the site backend.