This vulnerability (CWE-79) in Woocommerce Vietnam Checkout allows an attacker with high privileges and user interaction to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The issue arises from improper input sanitization during web page generation. It affects versions up to 2.0.7 of the plugin. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score of 5.9. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by the vendor. Until a patch is available, limit high-privilege user access and exercise caution with user input handling in the affected plugin. Monitor vendor channels for updates.