This vulnerability in the wpWax Product Carousel Slider & Grid Ultimate for WooCommerce plugin allows an attacker with high privileges and user interaction to inject and store malicious scripts due to improper input neutralization during web page generation. The stored XSS can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). The affected versions include all releases up to 1.10.0. No patch or vendor advisory is currently provided in the data.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, and disruption of service. The impact is limited by the requirement for user interaction and high privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access and monitor for suspicious activity related to this plugin. Avoid installing or updating to vulnerable versions of the plugin.