This CVE exposes a reflected XSS in a WooCommerce dynamic pricing plugin where user-controlled pricing data flows through the rule evaluation engine and renders directly to the page without output encoding. The critical detail is that it's unauthenticated — meaning the attack surface is the public-facing price display, cart summary, or pricing messages that the plugin renders for every visitor, not just logged-in administrators. No privilege boundary separates attacker from trigger.
The architectural root cause is telling: rule-based pricing systems are built to evaluate conditions and return formatted output, not to return data structures for downstream rendering. The developer who built this plugin conflated 'evaluate this pricing rule' with 'display this pricing rule result' — one function does both, and that function assumes its own output is safe to emit as HTML. That assumption is the vulnerability.
What makes this worse than a typical XSS: WooCommerce's hook system means this plugin's output doesn't stay contained. Pricing data publishes into a shared context that order processing, customer records, email templates, and admin dashboards consume. A payload injected into a price display can propagate through the hook ecosystem into order meta, admin interfaces, and checkout sessions. The CVSS 7.1 score captures exploit mechanics but understates the collateral damage through WooCommerce's data pipeline.
Remediation requires two phases. First, patch the plugin when available. Second — and this is the step most CVE notices skip — you must sanitize the database. The vulnerable plugin saved rule conditions as serialized blobs in product meta, order meta, and transients. A patch fixes the code but leaves malicious rule data sitting in your database, waiting to re-execute every time WooCommerce renders those stored values. Query your database for any pricing rules, discount conditions, or pricing-related meta that existed before the patch date and treat them as potentially malicious. Delete or re-save them through the patched interface.
If the plugin is abandoned or orphaned, the exposure becomes permanent. Abandoned pricing plugins leave their rule blobs in your database indefinitely, and those blobs will render without encoding every time WooCommerce touches the associated data. Audit your installed plugins and remove any dynamic pricing extensions no longer actively maintained.