This vulnerability in WPFactory's Change Add to Cart Button Text for WooCommerce plugin allows stored cross-site scripting due to improper input neutralization when generating web pages. It affects all versions up to 2.2.2. The attack requires low privileges and user interaction but can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, and low impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or other advisories.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The vulnerability requires low privileges and user interaction, limiting the ease of exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's configuration interfaces to trusted users only and monitor for suspicious activity. Avoid exposing the affected plugin on publicly accessible sites if possible. Follow vendor channels for updates on patches or official mitigations.