The FloristPress for Woo plugin is vulnerable to reflected cross‑site scripting through the 'noresults' parameter. Insufficient input sanitization and output escaping allow an unauthenticated attacker to supply malicious content in this parameter, which is then reflected back to the user without proper encoding. The result is that arbitrary web scripts can be executed in the target’s browser when a vulnerable page is accessed, enabling client‑side attacks such as phishing or malicious content execution.

Any WordPress site that has installed FloristPress for Woo – Customize your eCommerce store for your Florist plugin with a version equal to or older than 7.8.2 is affected. The vulnerability resides in the core/ajax.php file that processes the search‑result response when no items are found.

The CVSS base score of 6.1 indicates moderate severity. This flaw is unauthenticated and remote; an attacker must craft a URL containing a malicious payload in the 'noresults' parameter and lure a user to click that link. There is no EPSS data and the vulnerability is not listed in the CISA KEV catalog, but the potential for exploitation exists if users are tricked into visiting a malicious link.