Unauthenticated Cross Site Scripting (XSS) is found in the Additional Order Filters for WooCommerce WordPress plugin, affecting versions 1.24 and earlier. The flaw allows an attacker to inject malicious script into the plugin’s output, which may subsequently be executed in users’ browsers when they view filtered order lists. This weakness arises from improper input validation during the rendering of filter parameters, classified as CWE‑79.

WordPress sites that have installed the Anton Bond "Additional Order Filters for WooCommerce" plugin with a version number of 1.24 or older are vulnerable. All other plugin versions are presumed not to contain the flaw.

The CVSS score of 7.1 indicates a high severity. EPSS data is unavailable and the issue is not included in the CISA KEV catalog. The attack vector is unauthenticated, meaning an attacker can exploit the vulnerability simply by accessing or manipulating the plugin's filter interface via crafted URLs or form inputs that are echoed without proper sanitization.