The vulnerability permits an unauthenticated attacker to insert arbitrary JavaScript into the 'vat_number' field of orders. When an administrator later views or edits the order in WooCommerce, the stored payload executes with the privileges of the admin user, allowing the attacker to compromise the administrator account or take complete control of the site.

WordPress installations running WooCommerce that have the EU VAT Assistant for WooCommerce plugin by daigo75 in any version up to and including 2.1.30.260413 are affected; newer versions contain the fix.

The flaw carries a CVSS score of 7.2, and no EPSS score is currently available, indicating the exploitation probability is unknown but possible. It is not listed in CISA KEV. Because the attack vector is unauthenticated input that is stored and later rendered in an administrator context, an attacker can exploit the vulnerability without prior access and elevate privileges by injecting malicious code.