This vulnerability in VillaTheme Email Template Customizer for WooCommerce (<= 1.2.9.1) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS score is 5.9 (medium severity) with network attack vector, low attack complexity, high privileges required, and user interaction needed. No patch or official remediation guidance is currently provided.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in other users' browsers, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score of 5.9, reflecting limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit high privilege user access to the plugin and avoid interacting with untrusted input in the Email Template Customizer. Monitor official VillaTheme communications for updates.