The Waitlist WooCommerce (Back in stock notifier) plugin does not properly sanitize the 'type' shortcode attribute, allowing an authenticated user with contributor-level or higher privileges to store malicious JavaScript payloads. When a page containing the injected shortcode is rendered, the script executes in visitors' browsers. The stored XSS can potentially enable session hijacking, defacement, or other client‑side attacks – these potential consequences are inferred from the ability to execute arbitrary JavaScript. The flaw is a classic stored XSS vulnerability arising from improper input validation and output handling (CWE‑79).

The vulnerability affects the WordPress plugin "Waitlist WooCommerce (Back in stock notifier)" by xootix. All versions up to and including 2.9.1 are impacted. WordPress sites that have installed this plugin and have users with contributor or higher roles are potentially susceptible.

According to the CVSS v3.1 score of 6.4 the flaw is classified as moderate severity. The EPSS score is not available, leaving exploitation probability uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated as a contributor or higher to inject the payload. Once injected, the malicious script is available to any user who visits a page that expands the shortcode, making the impact widespread across the site's audience. Based on the description, it can be inferred that the absence of client‑side defenses such as Content Security Policy or stricter role restrictions might increase the effective attack surface; however, this is not explicitly stated.