The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are then stored in the product page. When a visitor loads the affected page, the injected code executes in their browser, potentially leading to site defacement, cookie theft, or session hijacking. This stored XSS flaw is significant because it can affect all users who view the compromised content.

WebCodingPlace’s WooCommerce Coming Soon Product with Countdown plugin for WordPress is affected for all releases up through version 5.0 inclusive. Administrators who have editing rights on the plugin settings or product pages could introduce the malicious payload.

With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to access the plugin’s configuration or content editing interface—likely requiring authenticated privileged access—to inject the script, after which the stored payload would execute for any user who views the product page.