Improper neutralization of input in the Smart Online Order for Clover WordPress plugin results in a stored cross‑site scripting vulnerability. When an attacker injects malicious JavaScript into the plugin’s data, the script runs in the browser of any user who views the affected page. This can lead to session hijacking, phishing attacks, defacement, or other client‑side compromise. The weakness is a classic input validation flaw identified as CWE‑79.

The vulnerability affects the ZAYTECH Smart Online Order for Clover plugin for WordPress with versions up to and including 1.6.0. Any WordPress site that has installed the plugin in those versions is susceptible.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, so the probability of exploitation cannot be quantified from the data; the vulnerability is not currently listed in the CISA KEV catalog, implying that no widely known exploits exist at this time. The most probable attack vector is web‑based; an attacker would need to submit malicious input through the plugin’s management interface, which will then be displayed to end users.