The vulnerability CVE-2024-54328 affects the Invoice Payment for WooCommerce plugin by linknacional, specifically versions up to 1.7.2. It is a reflected cross-site scripting (XSS) flaw caused by improper sanitization of user input during web page generation. This allows an attacker to craft malicious URLs or inputs that execute scripts in the victim's browser, potentially leading to information disclosure, manipulation of content, or disruption of service. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of users visiting the affected web pages. This may lead to theft of sensitive information, session hijacking, or manipulation of displayed content, impacting confidentiality, integrity, and availability to a limited extent. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for updates from linknacional or the plugin repository. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and limit exposure by restricting access to the affected plugin functionality where possible.