The CashBill.pl – Płatności WooCommerce plugin is vulnerable to a stored XSS flaw caused by improper neutralization of input during web page generation. When an attacker stores malicious script through the plugin, the input is later rendered without encoding, allowing the script to run in the browsers of any visitor who loads the affected page. This can lead to session hijacking, defacement, or further attacks from the compromised context. The weakness is classified as CWE‑79.

This vulnerability affects installations of the CashBill.pl – Płatności WooCommerce WordPress plugin with version 3.2.1 and all earlier releases. Sites using the plugin for WooCommerce payments are potentially impacted and should verify their current plugin version.

With a CVSS score of 5.9, the flaw represents moderate risk. The EPSS score of less than 1% indicates a low likelihood of current exploitation, and it is not listed in CISA’s KEV catalog. However, because the XSS payload is stored, it remains in the database and will be executed for every user who views the affected content, making the attack potentially far‑reaching if the plugin is not fixed. Based on the description, the likely attack vector involves any user who can access a page containing the vulnerable content, either authenticated or unauthenticated.