This vulnerability in the axima Pays – WooCommerce Payment Gateway plugin (versions up to 2.6) allows an attacker to exploit a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS). The CVSS 3.1 score of 7.1 indicates a high-severity issue with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability with a scope change. No official patch or mitigation details are currently available.

Successful exploitation can allow an attacker to execute unauthorized actions on behalf of an authenticated user via CSRF, and inject stored XSS payloads, potentially leading to session hijacking, data manipulation, or denial of service. The CVSS score reflects partial loss of confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling or restricting use of the affected plugin version. Monitor vendor channels for updates and apply official fixes promptly once released.