An unauthenticated cross‑site scripting vulnerability exists in Swatchly – WooCommerce Variation Swatches for Products plugin versions 1.4.13 and earlier. The flaw allows an attacker to inject arbitrary JavaScript into a page rendered for any user viewing a product that utilizes variation swatches. This could be used to steal session cookies, deface the website, or redirect users to malicious sites. The weakness corresponds to CWE‑79, which indicates improper handling of user‑supplied input in a web context.

The vulnerability affects the HasThemes Swatchly – WooCommerce Variation Swatches for Products WordPress plugin up to, and including, version 1.4.13. WordPress sites that have installed these versions of the plugin and display product variation swatches are exposed. No other plugins or WordPress core components are directly impacted by this flaw.

The CVSS score of 7.1 reflects a medium to high impact and the potential for compromising confidential information or user sessions. EPSS data is not available, so the likelihood of exploitation cannot be determined from that metric; however, the lack of authentication requirements and the common use of this plugin elevate the urgency. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and the public nature of the flaw mean that an attacker could feasibly target exposed sites with a simple crafted request to a product page.