The Codisto Omnichannel for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the sync() function due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability affects all versions up to 1.3.65. The CVSS 3.1 score of 7.2 reflects a high severity with network exploitability, no required privileges or user interaction, and impacts on confidentiality and integrity. No patch or official fix details are currently available, and no exploits have been reported in the wild.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in theft of sensitive information or unauthorized actions performed on behalf of the user. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the attack requires no privileges or user interaction, it poses a significant risk to users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin versions to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once available.