The Advanced Order Export For WooCommerce plugin contains a cross‑site scripting flaw that allows an attacker to inject malicious script payloads into exported order data. Because the plugin does not properly sanitize or escape user‑supplied input, a malicious script can be executed within the context of the WordPress site, potentially leading to session hijacking, cookie theft, defacement, or unauthorized content injection. This weakness is classified as CWE‑79 and carries a moderate to high severity.

The vulnerability affects the Algolplus Advanced Order Export For WooCommerce plugin, specifically all versions up to and including 4.0.9. Users running any of these versions on a WordPress site are impacted.

The CVSS score of 7.1 indicates a high impact when the vulnerability is exploited. The EPSS score is not available, so the probability of an imminent exploit cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated WordPress administrator or user with access to the order export interface crafting malicious input that is then reflected in the exported data; from there, a script execution may occur in a victim’s browser. Attack prerequisites appear limited to having sufficient permissions to use the export function and an ability to inject script content.