The 'Export Products, Orders & Customers for WooCommerce' plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 2.0.15. An attacker can exploit this by crafting a URL that, when clicked by a user, executes arbitrary JavaScript in the context of the victim's browser session.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of cookies, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication. The CVSS vector indicates low complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to this plugin and consider disabling or removing the plugin if feasible. Monitor the vendor's communications for updates on patches or official fixes.