The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'autoship-create-scheduled-order-action' shortcode. This vulnerability results from improper neutralization of user-supplied input due to insufficient sanitization and escaping, allowing authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 2.8.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no impact on availability. No patch or official fix has been documented at this time.

An authenticated attacker with contributor-level access or higher can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and avoid using the vulnerable shortcode with untrusted input. Monitor vendor channels for updates and apply patches promptly once available.