The vulnerability is a subscriber‑level Cross Site Scripting flaw in the VillaTheme Product Variations Swatches for WooCommerce plugin, versions 1.1.18 and earlier. It allows an attacker to supply crafted input that the plugin later outputs without proper sanitization, resulting in the execution of malicious JavaScript in the context of the victim’s browser. The flaw is classified as CWE‑79 and can be used to steal credentials, deface storefront pages, or redirect users to phishing sites.

Only the VillaTheme Product Variations Swatches for WooCommerce plugin when installed at version 1.1.18 or lower is affected. Site administrators and developers of WordPress WooCommerce sites should confirm the installed version and update if necessary. No other products or vendors are listed as impacted.

With a CVSS score of 6.5, the vulnerability carries a moderate severity rating. EPSS data is not available and the issue is not listed in the CISA KEV catalog, indicating limited evidence of widespread exploitation. Based on the description, it is inferred that an attacker can inject hostile scripts by sending a crafted request (e.g., filling a product variation field) that the plugin renders without escaping. No privileged access or elevated permissions are required; any user with the ability to submit or edit product variations could potentially exploit the flaw.