The Call for Price for WooCommerce plugin for WordPress is vulnerable to stored cross‑site scripting through the administrator configuration of the product type label. The flaw stems from insufficient input sanitization and output escaping, allowing an authenticated attacker with administrator‑level permissions to inject arbitrary JavaScript that executes whenever a user loads a page containing the injected label. This can be leveraged to deface the site, steal session cookies, or perform other client‑side malicious actions.

TycheSoftware’s Call for Price for WooCommerce plugin is affected in all releases up to and including 4.2.0. The vulnerability is limited to multi‑site WordPress installations where the unfiltered_html option is disabled, and requires an administrator access level to exploit.

The CVSS score of 4.4 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the administrative settings page of the plugin, requiring evidence of administrator privileges to inject the payload. If an attacker can access these settings, they can load malicious script into the site for all users who view the affected page.