The flaw is a stored cross‑site scripting vulnerability that allows an attacker to inject and store malicious JavaScript in the Mini Ajax Cart for WooCommerce plugin data. When users load the cart page, the unsanitized input is rendered in the browser, which can lead to defacement, cookie theft, or session hijacking. This weakness falls under the category of insecure input handling (CWE‑79).

Vendors: HashThemes; Product: Mini Ajax Cart for WooCommerce plugin. All releases up through 1.3.4 are affected, including the initial release through that version.

The CVSS v3.1 score is 5.9, indicating a medium severity issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. Likely attack paths involve submitting malicious data through the cart interfaces, which is stored and later displayed to any user who views the cart. While the flaw does not provide direct server‐side code execution or privilege escalation, an attacker can compromise the browsing session of any visitor to the site.