The European VAT Compliance Assistant for WooCommerce plugin for WordPress contains an unauthenticated stored cross‑site scripting flaw that arises from the CF‑IPCountry HTTP header. During a guest checkout the plugin writes the value of that header into order post‑meta without sanitization or escaping, thereby persisting arbitrary JavaScript. Any user who later views the order page will have the injected code executed within their browser, potentially enabling session cookie theft, account hijacking, site defacement, or the exfiltration of other sensitive data.

The vulnerability applies to the David Anderson European VAT Compliance Assistant for WooCommerce plugin for WordPress in all versions up to and including 1.36.10. It operates on WooCommerce‑based WordPress sites that permit guest checkout, allowing the vulnerable code to be executed on any order page generated by the plugin.

The CVSS score of 7.2 classifies the flaw as high severity. Because the attack requires only an HTTP header injection during a guest checkout and imposes no authentication requirements, the exploitation path is straightforward for a motivated adversary. No public exploits have been reported and the flaw is not listed in the CISA KEV catalog, but the impact remains significant for sites that expose guest checkout functionality.