SUMO Reward Points for WooCommerce is vulnerable to an unauthenticated stored cross‑site scripting flaw. The vulnerability is caused by the REST API endpoint /wp-json/wc-srp/v1/earning exposing the rs_earning_read capability to all users, combined with missing sanitization of the reason parameter in creating earning records and missing output escaping when rendering the Master Log. An attacker can inject arbitrary JavaScript into the reward points log entry; the injected script is executed whenever an administrator views the Master Log or User Reward Points pages, allowing the attacker to run code in the admin browser context. This flaw is a data‑injection issue annotated as CWE‑79. Based on the description, it is inferred that the malicious script could be used to hijack the administrator’s session or deface the interface, although the CVE description does not explicitly state these outcomes.

WordPress sites that have installed the SUMO Reward Points for WooCommerce plugin from FantasticPlugins version 32.7.0 or earlier. No other products or newer versions are listed as affected.

The CVSS score of 7.2 denotes a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable REST endpoint without authentication by sending normal HTTP requests, supplying a crafted reason value that contains malicious script, and storing it in the log. The stored payload is then rendered in the admin pages, leading to stored XSS. Based on the description, it is inferred that exploitation could allow attackers to execute JavaScript in the context of the site administrator, potentially leading to session hijacking or defacement.