The YITH WooCommerce Quick View plugin for WordPress versions up to and including 2.7.0 contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin's yith_quick_view shortcode does not adequately sanitize or escape user-supplied attributes, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impacts without availability impact. There is no vendor advisory or patch link available, and no known exploits in the wild have been reported.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The vulnerability affects confidentiality and integrity but does not impact availability. The medium CVSS score reflects these impacts and the required privileges for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the YITH WooCommerce Quick View plugin if feasible. Monitor for updates from the vendor and apply any official patches promptly once available.