The Booster for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper input validation (CWE-20) in shortcode attributes. Authenticated users with contributor-level or higher permissions can inject arbitrary web scripts that persist and execute in the context of other users viewing the injected pages. This vulnerability affects all versions up to 7.1.7 and has a CVSS 3.1 score of 6.4, reflecting a medium severity impact on confidentiality and integrity. No patch or official fix information is currently available, and no exploits have been reported in the wild.

Successful exploitation allows an authenticated contributor or higher user to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the context of other users viewing the page, potentially leading to theft of session tokens, user impersonation, or other actions limited by the permissions of the victim user. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or limiting the use of shortcodes from this plugin. Monitor plugin updates closely and apply any official patches promptly once available.