The Booster for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape input data that is normally processed by wp_kses, enabling attackers to inject malicious scripts into pages such as comment sections. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other malicious actions. The vulnerability affects all versions up to and including 7.2.4 and does not require authentication to exploit.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the browsers of users who visit the affected pages. This can lead to information disclosure and integrity compromise, such as theft of user credentials or manipulation of page content. The vulnerability does not impact availability. The CVSS vector indicates low attack complexity, no privileges required, no user interaction needed, and scope change, highlighting the ease and potential severity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting the use of affected plugin features that handle user-supplied input or apply additional input sanitization and output escaping measures. Monitoring official pluggabl communications for updates is recommended.