An unauthenticated Cross Site Scripting flaw exists in all WordPress Facebook for WooCommerce plugin releases up to and including 3.7.5. The weakness is identified as CWE‑79. Attackers can inject malicious JavaScript that runs in the context of any user who views a page containing the tainted data, potentially leading to cookie theft, defacement, or further lateral movement within the site.

WordPress installations that employ the Facebook for WooCommerce plugin version 3.7.5 or earlier are affected. The vendor is Facebook and the product is the WooCommerce‑integrated Facebook plugin, which can be present on any ecommerce WordPress site using WooCommerce.

The CVSS score of 7.1 indicates a moderate‑to‑severe risk. EPSS data is not published, and the vulnerability is not listed in CISA’s KEV catalog, but the absence of an EPSS score does not preclude exploitation. Because the flaw is unauthenticated and can be triggered by user‑supplied content, any visitor to a vulnerable site may become a victim. Attackers need only to craft a payload that reaches the vulnerable input endpoint; once executed, the script runs with the privileges of the web page load. The relatively high CVSS and open‑world nature of the vector make this a credible threat for active sites that rely on the plugin.