This vulnerability (CVE-2024-25596) in Doofinder for WooCommerce is classified as CWE-79, indicating improper neutralization of input during web page generation leading to stored cross-site scripting. The issue allows an attacker with high privileges and user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, requiring privileges and user interaction, and a scope change. The vulnerability affects all versions up to 2.1.8. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates that exploitation requires user interaction and privileges, and the scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with plugin usage and restrict privileges to trusted users. Monitor for vendor updates regarding patches or mitigations.