This vulnerability involves improper neutralization of input during web page generation in the Doneren met Mollie plugin, leading to stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that are stored and later executed in the context of other users, potentially affecting confidentiality, integrity, and availability. The vulnerability affects all versions up to 2.10.7. There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected web pages, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The attack requires user interaction and low privileges, limiting but not eliminating risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official fixes.