The Brevo for WooCommerce plugin allows an unauthenticated attacker to store arbitrary JavaScript by submitting a crafted value for the parameter user_connection_id. The plugin later outputs this value without escaping, so the injected script runs in the context of any site visitor who accesses an affected page, potentially enabling session hijacking, defacement, or traffic redirection. The weakness corresponds to CWE‑79, a classic example of stored cross‑site scripting that compromises both confidentiality and integrity of users.

All WordPress sites that have the Brevo for WooCommerce plugin version 4.0.49 or earlier installed are affected. The vulnerability exists in every release up to and including 4.0.49, regardless of site role or configuration, and can impact any page rendered by the plugin.

The CVSS score of 7.2 indicates high severity. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated submission of the malicious user_connection_id value, inferred from the plugin's use of the parameter; an attacker could provide the payload through an exposed configuration endpoint or admin interface.