This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in the Swatchly – WooCommerce Variation Swatches for Products plugin. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability. Affected versions include all versions up to 1.4.13. No patch or official remediation level has been published by the vendor as of the provided data.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS score of 7.1 indicates a high severity with impacts on confidentiality, integrity, and availability, albeit at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider applying temporary mitigations such as disabling or restricting the plugin if feasible, or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin.