This vulnerability (CVE-2024-37217) in the ProWCPlugins Empty Cart Button for WooCommerce plugin is classified as CWE-79, indicating improper neutralization of input leading to stored Cross-site Scripting (XSS). It affects versions through 1.3.8. The flaw allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, defacement, or other malicious actions affecting confidentiality, integrity, and availability to a limited degree. The attack requires user interaction and low privileges, limiting the scope but still posing a risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input where possible and applying web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor plugin updates from ProWCPlugins for a forthcoming patch.