An unauthenticated cross‑site scripting flaw exists in the Midtrans‑WooCommerce WordPress plugin up through version 2.32.3. The plugin reflects user‑supplied data onto pages without proper sanitization, allowing an attacker to inject and execute malicious JavaScript in the browsers of visitors who view those pages. Because the attack does not require authentication, any user who visits a vulnerable site can trigger the flaw. The injected script runs with the privileges of the visitor’s browser session, potentially enabling actions that the site intended to be safe for. The likely impact includes compromise of data confidentiality and integrity for users, and a degradation of the site's overall usability. The vulnerability carries a CVSS score of 7.1, indicating a high level of risk. The EPSS score of <1% indicates a low probability of exploitation, while it is not listed in the CISA KEV catalog, but the potential for exploitation remains.

WordPress sites installed with the Midtrans‑WooCommerce plugin version 2.32.3 or earlier are affected. This includes any WordPress installation that still uses that version or earlier without upgrading the plugin.

The flaw is publicly exploitable because no authentication is required. Attackers can simply embed malicious scripts in content rendered by the plugin, causing code execution in the victim’s browser. With a CVSS score of 7.1 the vulnerability is considered high risk, and the EPSS score of <1% indicates a low probability of exploitation, while it is not listed in the CISA KEV catalog, but the potential for exploitation remains.