The plugin contains a Cross‑Site Request Forgery flaw that allows an attacker to store malicious JavaScript in the plugin’s data store. When the stored content is later rendered in a user’s browser, the injected script executes with that user’s privileges.

WordPress sites that have the Nicolas GRILLET Woocommerce – Loi Hamon plugin version 1.1.0 or earlier are affected. The plugin can be installed on any WooCommerce‑enabled WordPress site through the WordPress repository.

The CVSS score of 7.1 places the issue in the high‑severity category. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a CSRF attack that does not require prior authentication, relying on a crafted request from an unsuspecting authenticated user.