CVE-2024-9895 is a stored cross-site scripting vulnerability in the Smart Online Order for Clover WordPress plugin, affecting all versions up to and including 1.5.7. The issue stems from improper neutralization of input in the moo_receipt_link shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts, but no availability impact is noted. The vulnerability is classified under CWE-79.

Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity compromise, such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor vendor channels for updates regarding patches or official mitigations.