The Dynamic Pricing With Discount Rules for WooCommerce plugin versions prior to 5.0.0 contain a reflected XSS vulnerability (CWE-79) due to missing nonce and capability validation on an AJAX action. This flaw allows unauthenticated attackers to inject and execute arbitrary scripts by crafting a request that reflects unsanitized input back to the victim, potentially leading to session hijacking or other script-based attacks. No CVSS score or official remediation details are currently available.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to session hijacking, defacement, or other malicious actions performed on behalf of the victim. The vulnerability requires the victim to be induced to send a crafted request, and the attacker does not need to be authenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX action if possible and avoid interacting with suspicious links or requests related to this plugin. Monitor for updates from the plugin vendor and apply patches promptly once released.