The Import and export users and customers WordPress plugin by carazo suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the user agent header. Authenticated users with administrator privileges can inject arbitrary scripts into pages generated by the plugin, which execute when viewed by other users. This vulnerability affects all versions up to 1.26.6.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact with no availability impact.

An attacker with administrator access can inject persistent malicious scripts via the user agent header, potentially leading to unauthorized actions performed in the context of other users viewing the injected pages. The impact is limited to confidentiality and integrity with low severity, and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted administrators. Follow vendor updates for any forthcoming patches or official mitigations.