The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting in the Risk Free Cash On Delivery (COD) – WooCommerce plugin. An attacker can inject arbitrary JavaScript that executes whenever the stored data is rendered, potentially enabling cookie theft, session hijacking or malicious manipulation of page content. This flaw is a classic stored XSS (CWE‑79) and does not provide direct server‑side code execution.

All releases of everythingwp Risk Free Cash On Delivery (COD) – WooCommerce up through version 1.0.4 are affected. Any WordPress installation that has this plugin installed and is running a version 1.0.4 or earlier is vulnerable. Versions newer than 1.0.4 are not impacted according to the vendor’s statement.

The CVSS score of 5.9 places this vulnerability in the medium severity range. The EPSS score of <1% indicates that exploitation is currently rare in the wild. The CVE does not disclose the exact attack vector, but it is inferred that the attacker would supply a malicious payload via the plugin’s input fields, such as transaction notes, which the plugin stores and displays. Because this likely requires authentication with permission to write to those fields, the attack vector is inferred to be local through the website’s own interface; no elevated privileges beyond normal authenticated use are needed. The vulnerability is not listed in CISA’s KEV catalog.