The vulnerability is an unauthenticated Cross‑Site Scripting in StoreGrowth Smart Sales Booster for WooCommerce through versions 2.0.6 and earlier. A malicious script can be injected into pages viewed by site visitors, which may lead to theft of session cookies or other sensitive data. The weakness corresponds to improper input handling (CWE‑79).

Attackers can target any WordPress installation running the weDevs StoreGrowth plugin up to version 2.0.6, including sites using WooCommerce. The plugin is commonly distributed via the WordPress plugin repository and used by e‑commerce sites that implement buy‑one‑get‑one, upsells, or side cart features.

The CVSS score of 7.1 indicates a high level of severity, while the EPSS score of 0.00237 indicates a very low exploitation probability, suggesting no publicly known exploitation trend. The vulnerability is not listed in CISA's KEV catalog. Unauthenticated XSS generally allows an attacker to inject scripts via public plugin interfaces. The likely attack vector involves placing malicious payloads in plugin settings or data fields that are later rendered in browsers without proper escaping. Successful exploitation could result in confidentiality and integrity violations, allowing attackers to hijack user sessions or deface the site.