This vulnerability in WPFactory Maximum Products per User for WooCommerce (<= 4.4.3) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary scripts in a victim's browser, potentially leading to information disclosure, data manipulation, or denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. The attack requires the attacker to have some privileges and user interaction, limiting the ease of exploitation. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input capabilities and monitoring for suspicious activity related to this plugin. Avoid granting unnecessary privileges to users who can interact with the vulnerable functionality.