This vulnerability in the SOFTAGON WooCommerce Products without featured images plugin allows an attacker to exploit CSRF to perform unauthorized requests on behalf of an authenticated user. Additionally, the issue involves reflected XSS, which can be leveraged to execute malicious scripts in the context of the victim's browser. The affected versions include 0 through 0.1. No CVSS score or patch information is provided.

Successful exploitation could allow attackers to perform unauthorized actions within the affected WooCommerce plugin context and potentially execute malicious scripts via reflected XSS. This could lead to unauthorized changes or data exposure depending on the privileges of the affected user. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected plugin or restricting access to trusted users only. Monitor official SOFTAGON channels for updates and patches addressing this vulnerability.