Improper Neutralization of Input During Web Page Generation results in a DOM-Based Cross-Site Scripting vulnerability in the VillaTheme CURCY Woo-Multi-Currency plugin. An attacker can craft a page or link that triggers arbitrary client-side script execution in the browsers of any site visitor when the vulnerable plugin processes that input. Since the vulnerability does not require authentication, malicious code can obtain session cookies, deface the site, or launch phishing or other client-side attacks, threatening the confidentiality, integrity, and availability of users and the website.

This vulnerability affects the CURCY – Multi Currency for WooCommerce plugin developed by VillaTheme, available for WordPress. All installations of CURCY 2.2.18 are vulnerable.

The CVSS score of 7.1 indicates a high severity level. EPSS score is <1%, indicating a very low exploitation probability, but the lack of authentication requirements makes the attack vector easy to exploit. The vulnerability is not listed in the CISA KEV catalog, yet the potential for widespread impact remains because any visitor to the affected site could be exposed to malicious scripts.