This vulnerability (CVE-2024-39666) in Automattic WooCommerce is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-site Scripting (XSS). It affects WooCommerce versions through 9.1.2. The CVSS 3.1 base score is 5.9 (medium), with attack vector network, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or official remediation level has been disclosed by the vendor, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected WooCommerce installation, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. However, the impact is rated medium due to the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit high privilege user access and exercise caution with user input handling in WooCommerce. Monitor vendor channels for updates.