A Cross-Site Scripting vulnerability in the Product Addons and Product Options With Custom Fields WordPress plugin allows unauthenticated attackers to execute malicious scripts in a user's browser.

The plugin contains a Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. An unauthenticated attacker can exploit this flaw by injecting malicious scripts that execute within the context of a victim's session.

Successful exploitation of this XSS vulnerability can lead to session hijacking, unauthorized actions performed on behalf of a user, or the theft of sensitive session cookies. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment, potentially allowing attackers to compromise administrative accounts if an administrator interacts with the malicious payload.

Immediate Action: Update the Product Addons and Product Options With Custom Fields plugin to version 1.6.15 or higher immediately.

Proactive Monitoring: Monitor web server access logs for unusual request patterns, particularly those containing script tags or encoded characters directed at plugin-specific endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common XSS attack patterns targeting the plugin's input fields.

Public Exploit Available: No

The high severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the affected plugin to the latest version to prevent potential session compromise and unauthorized access to the WordPress application.