The NikanWP WooCommerce Reporting plugin has a Cross‑Site Request Forgery (CSRF) flaw that permits an attacker to submit crafted requests on behalf of an authenticated user. Because the plugin accepts and stores data without proper CSRF protection, a malicious payload can be inserted into reporting fields and persistently stored. When a legitimate user later opens the report, the stored script executes in their browser, giving the attacker the ability to steal session cookies, deface content, or perform actions as that user. The vulnerability is classified as CWE‑352 and results in stored cross‑site scripting (XSS).

Affected systems are sites running the NikanWP WooCommerce Reporting WordPress plugin at version 1.0.0 or earlier. Any WordPress installation that has the plugin installed without updates is at risk.

The CVSS score is 7.1, reflecting a moderate to high severity. The EPSS score is below 1%, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to lure a user with sufficient privileges to the crafted request, typically via a malicious link or form. Because the flaw operates via CSRF, the team or admin must be aware of the attack vector and its prerequisites.