The WPC Product Bundles for WooCommerce plugin accepts a numeric quantity field that is insufficiently sanitized, allowing an attacker to insert arbitrary HTML and JavaScript. The input is cast to a float, which removes the leading numeric portion of a malicious payload (for example, "1<img…>") while preserving the script tags. This data is then stored unchanged in order item metadata under the key _woosb_ids and rendered on page loads. When a user visits a page that displays the order items, the browser executes the injected script, enabling client‑side code execution, session hijacking, defacement, or phishing of that user. The vulnerability exists in all releases up to and including 8.6.6 and requires no authentication to perform the injection, but the attacker’s effect is limited to the victim’s browser.

The affected product is the WPC Product Bundles for WooCommerce plugin from wpclever. All versions from the initial release through 8.6.6 are vulnerable. No other versions or variants are listed in the advisory.

The CVSS score of 7.2 indicates high severity. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, so the exploitation probability cannot be precisely quantified. The attack vector is unauthenticated, relying on interaction with the quantity input field or access to a page that renders the stored order item metadata. If an attacker can supply a crafted 'qty' value and the site displays the order information to other users, the injected script will run in their browsers. The lack of a KEV listing suggests no widespread public exploitation yet, but the high CVSS and shared code base make it a credible threat for any website running the vulnerable plugin.