This vulnerability is a Cross‑Site Request Forgery that allows attackers to inject malicious JavaScript that is stored by the plugin. The stored script executes whenever any user loads the affected page, giving attackers the ability to steal credentials, hijack sessions, deface content, or otherwise manipulate the site. The weakness is identified as CWE‑352 and poses a risk to confidentiality, integrity, and availability of any WordPress site that runs the vulnerable plugin.

WordPress sites running the FraudLabs Pro for WooCommerce plugin version 2.22.8 or older, distributed by fraudlabspro.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1 % suggests few current exploitation attempts, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited by sending a crafted POST request to the plugin’s endpoint that lacks CSRF protection; while the description does not state whether authentication is required, it can be inferred that an attacker who can reach the site’s URL can trigger the vulnerability from the web interface. Once the malicious input is stored, the attacker gains the typical capabilities of a stored XSS payload.