The CVSS 7.1 on this unauthenticated stored XSS in Product Feed Manager is deceptively ordinary. Treat it as something more serious. The EPSS score of 0.0018 tells you exploitation probability is currently low — but this reflects attacker interest in the plugin's ecosystem, not the actual blast radius if exploitation succeeds. These metrics measure different things, and collapsing them into a single risk judgment is a mistake that leaves supply-chain exposure invisible.
Here's why this matters more than the numbers suggest: Product Feed Manager plugins aggregate merchant data — pricing, affiliate identifiers, product URLs — and emit it to Google Shopping, Amazon, and comparison engines. A stored XSS payload injected into the feed output doesn't just compromise the admin session that reviews it; it poisons the data stream those downstream platforms trust. The attack surface isn't the plugin — it's every system that consumes the feed. One successful payload multiplies across N downstream consumers, each serving it to their own traffic. This is a trust-model problem: attackers compromising the feed don't need to target Google or Amazon directly; they've compromised the data source those systems trust.
The unauthenticated vector is the enabler. This makes mass exploitation trivially viable against any site running the plugin, regardless of user behavior. The low EPSS likely reflects that automated exploitation kits haven't yet added this specific plugin's feed-output path — not that the payload won't be devastating when they do. Historical patterns in similar product-sync and feed-manipulation plugins show exploitation probability spikes 60-90 days post-disclosure, when PoC code circulates and gets folded into attack toolchains.
For defenders: audit your feed-generation endpoints and verify they require authentication if they accept user-adjacent input. Review your feed output for any stored payloads that survived before patching. If you use this plugin, the remediation priority isn't just "patch the XSS" — it's treating the entire feed-output pipeline as a critical trust boundary, because that's exactly where attackers will aim. Monitor for feed-manipulation activity that doesn't look like typical XSS exploitation: corrupted product listings, price injection, or affiliate link tampering appearing in your downstream channels.
The headline score says medium-severity. The actual exposure, if this feeds into merchant infrastructure, is substantially higher.