This vulnerability (CVE-2024-37522) involves improper neutralization of input in the 'CC & BCC for Woocommerce Order Emails' plugin, resulting in stored cross-site scripting (CWE-79). It affects all versions up to 1.4.1. The CVSS 3.1 base score is 5.9, indicating a medium severity with network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute stored XSS attacks, potentially leading to partial compromise of confidentiality, integrity, and availability of affected systems. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit high-privilege access to the plugin and exercise caution with user input that could be stored and rendered by the plugin. Monitor vendor channels for updates.