This vulnerability in WPFactory Wishlist for WooCommerce (<= 3.1.2) involves improper neutralization of input during web page generation, resulting in a cross-site scripting (XSS) flaw. The CVSS score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker to inject malicious scripts that execute in the context of the affected web application.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, hijack user sessions, or perform actions on behalf of users. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider disabling or limiting use of the affected plugin. Monitor official WPFactory communications for updates regarding patches or mitigations.