The WCFM – Frontend Manager for WooCommerce plugin has a stored Cross‑Site Scripting flaw that allows an attacker to inject unescaped JavaScript into pages generated by the plugin. This can enable session hijacking, theft of credentials, defacement, or execution of arbitrary client‑side code in the context of the victim’s browser. The weakness maps to CWE‑79.

Users running the WordPress WCFM – Frontend Manager for WooCommerce plugin version 6.8.1 or earlier are affected. The vendor patches the issue in version 6.8.2 and later.

The CVSS score of 6.5 indicates a moderate severity vulnerability. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, suggesting it is not a highly exploited vulnerability at present. The likely attack vector is a normal user visiting a page rendered by the plugin that contains malicious content; authentication is not required if the vulnerable functionality is accessible to all site visitors. Because the flaw is stored, an attacker who can create or modify the content can persist the payload across sessions, potentially affecting many users.