CVE-2024-2752 is a stored cross-site scripting vulnerability (CWE-79) in the WooCommerce plugin 'Where Did You Hear About Us Checkout Field' by wooassist. The flaw exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of order meta fields. Authenticated users with shop manager or higher privileges can inject malicious scripts that persist and execute in the context of other users viewing the injected content. This vulnerability affects all versions up to and including 1.3.1. The CVSS 3.1 base score is 5.5, reflecting a network attack vector, low attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity without availability impact.

An attacker with shop manager-level permissions or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of other users viewing the injected order meta data. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed content. There is no impact on availability. The vulnerability requires authenticated access with elevated privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager-level permissions to trusted users only and monitor for suspicious activity. Avoid exposing order meta data to untrusted users where possible. Follow vendor updates closely for any released patches or official mitigations.