The Live Sales Notification for Woocommerce – Woomotiv WordPress plugin suffers from a reflected Cross-Site Scripting vulnerability (CWE-79) via the 'woomotiv_limit' parameter. This parameter is not properly sanitized or escaped before being included in web pages, allowing unauthenticated attackers to inject malicious scripts. Successful exploitation requires user interaction, such as clicking a crafted link. The vulnerability affects all versions up to 3.6.3. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impact. No patch or remediation details are currently provided by the vendor.

Exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected website for users who interact with a maliciously crafted link. This can lead to theft of user credentials, session hijacking, or other actions performed with the user's privileges. The impact is limited to confidentiality and integrity with no direct availability impact. Since the attacker is unauthenticated and the attack requires user interaction, the risk is moderate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to the affected functionality. Additionally, educating users about the risks of clicking untrusted links can help reduce exploitation likelihood.