Improper validation of the specified quantity field in the plugin's input handling allows malicious software to be implanted. Based on the description, it is inferred that this vulnerability, identified as CWE‑1284, could enable an attacker to execute arbitrary code with the privileges of the web server, threatening the confidentiality, integrity, and availability of the WordPress site.

All WordPress sites running ShapedPlugin, LLC’s Product Slider Pro for WooCommerce plugin versions before 3.5.4 are affected. The vendor has released version 3.5.4 which includes the fix.

The flaw has a CVSS score of 10, marking it as critical. With an EPSS score of 1% and not listed in CISA KEV, the likelihood of exploitation remains low, yet the potential impact remains high. Based on the description, it is inferred that the most likely attack vector is a crafted HTTP request to the plugin’s quantity handling endpoint, which could be triggered either by an authenticated user or by an unauthenticated visitor on a publicly accessible site.