The vulnerability is an Improper Neutralization of Input During Web Page Generation, resulting in a Stored Cross‑Site Scripting flaw in the Flexible Refund and Return Order for WooCommerce plugin. The likely attack vector involves injecting JavaScript, as the plugin stores refund and return data without proper sanitization; it is inferred that a malicious user can insert arbitrary script that persists and later renders to other users, giving attackers the ability to hijack sessions, steal credentials, or perform other malicious actions in the context of the victim’s browser. The weakness is identified as CWE‑79. The impact includes potential confidentiality, integrity, and availability compromises for users interacting with the affected WordPress site.

The flaw affects the wpdesk Flexible Refund and Return Order for WooCommerce plugin for all WordPress installations running any version up through 1.0.51 inclusive. Sites hosting the plugin on these or earlier releases are vulnerable regardless of the WordPress core version. Any user who can create or edit refunds or returns via the plugin’s interface may trigger stored data that will be rendered unsanitized.

The CVSS score of 6.5 indicates a moderate severity risk. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, implying a low probability of exploitation so far. Based on the description, it is inferred that an attacker could potentially exploit the vulnerability from the public web by submitting a crafted refund or return order that stores malicious payloads, which would later be rendered when the page is viewed. The likely attack vector does not require privileged access; once the data is stored, any user who views the affected page can be victimized.