The vulnerability allows an attacker to inject malicious scripts that are reflected in the website’s response without requiring authentication. If exploited, malicious code can run in the browser of any visitor, potentially enabling session hijacking, defacement, or phishing attacks. The weakness is a classic reflected XSS flaw, classified as CWE‑79.

The flaw affects the WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin versions 5.2.2 and earlier, distributed by WPFactory. Users running any of those versions are impacted.

The CVSS score of 7.1 indicates a high severity for a reflected XSS. The EPSS score of less than 1% suggests low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an unauthenticated user submitting a crafted URL or input that the plugin reflects back unsanitized, allowing the injection of script payloads.