An attacker can store malicious script code in the plugin’s input fields that is later rendered without neutralization, allowing execution of arbitrary code in the browsers of any visitor who loads the affected page. This stored XSS can lead to session hijacking, data theft, or defacement of the site, representing a moderate confidentiality and integrity risk.

The vulnerability affects the WordPress Nota Fiscal Eletrônica WooCommerce plugin provided by webmaniabr, from the earliest released version up to and including 3.4.0.9. Users deploying any of these versions are potentially exposed.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation at the time of this analysis. The issue is not listed in the CISA KEV catalog. Based on the description, an attacker who can submit data to vulnerable plugin fields—potentially any site user or an administrator—could trigger the stored XSS by inserting malicious script payloads that persist in the site’s content and execute in the browsers of site visitors.