The vulnerability is a CSRF flaw that allows an attacker to store a malicious script in the plugin’s data. Stored XSS can lead to client‑side code execution, which may be used to steal user information, deface the site, or redirect visitors to phishing sites. The weakness is identified as CWE‑352, a classic CSRF fault that bypasses user authorization.

This issue affects the Moloni Contribuinte Checkout WordPress plugin for all versions from the earliest available release through version 2.0.03 inclusive. The plugin is used by WordPress sites that require integration with Moloni’s invoicing system.

The CVSS score of 7.1 indicates a high severity. The EPSS score of <1% suggests that exploitation is unlikely at the current time, and the vulnerability is not present in the CISA KEV list. The likely attack vector is a forged request from a malicious site, exploiting the missing CSRF protection to inject and store a script that later executes in the context of site visitors.