The Checkout with Cash App on WooCommerce plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input in the '_wp_http_referer' parameter. This affects all versions up to 6.0.2. Attackers can inject malicious scripts that execute in the context of a user's browser if the user interacts with a crafted URL. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions within the affected web application context. The vulnerability does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin or applying manual input sanitization and output escaping if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor the vendor's communications for updates on patches or official mitigations.