The vulnerability resides in the Settings page of the Experto Dashboard for WooCommerce plugin where certain fields such as ‘Navigation Font Size’, ‘Navigation Font Weight’, ‘Heading Font Size’, ‘Heading Font Weight’, ‘Text Font Size’, and ‘Text Font Weight’ are stored without sanitization or escaping. This permits an authenticated user with Administrator or higher privileges to embed arbitrary JavaScript that will run for any user who visits the Settings page, enabling the attacker to perform actions such as phishing, cookie theft, or defacement.

The affected product is the Experto Dashboard for WooCommerce plugin by uxdexperts, available for WordPress installations. All releases up to and including version 1.0.4 are vulnerable. The issue manifests only in multi‑site WordPress environments where the unfiltered_html capability is disabled, and the attacker must have permission to edit plugin settings.

The CVSS score of 4.4 places the severity in the moderate range, and because the exploit requires authenticated access it is less likely to be abused broadly. No EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog, which suggests limited public exploitation. Nevertheless the impact of an attacker executing arbitrary code for other site users remains significant, and the issue can be leveraged to compromise the entire WordPress installation if additional weaknesses exist.