This vulnerability in WPFactory's Product Notes Tab & Private Admin Notes for WooCommerce plugin allows stored cross-site scripting due to improper input sanitization during web page generation. It affects all versions up to 3.1.0. The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently referenced, and no known exploits are reported.

Successful exploitation of this vulnerability could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts within the context of the affected WooCommerce plugin. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or data. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin features to trusted users only and monitor for suspicious activity related to stored scripts. Avoid relying on generic mitigations unless specifically recommended by the vendor.