This vulnerability in the Laybuy Payment Extension for WooCommerce (up to version 5.3.9) involves improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows an attacker with at least limited privileges and user interaction to inject and store malicious scripts that execute in the context of other users' browsers. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low. No official remediation or patch has been documented yet.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of affected users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires user interaction and some level of privileges, limiting the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting user input where possible and monitor for suspicious activity related to this extension. Avoid granting unnecessary privileges to users interacting with the payment extension to reduce risk.