The Woocommerce – Products By Custom Tax plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) via the 'woo_products_custom_tax' shortcode. This vulnerability allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript code due to improper input sanitization and output escaping of shortcode attributes. When a user accesses a page containing the injected shortcode, the malicious script executes, potentially compromising user sessions or data. The vulnerability affects all versions up to 2.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, potentially exposing sensitive information or enabling further attacks. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Woocommerce – Products By Custom Tax plugin if feasible. Monitor for updates from the vendor or security advisories to apply an official patch once available.