This vulnerability in the WooCommerce Additional Fees On Checkout (Free) WordPress plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.5.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability. No vendor patch or advisory is currently available, and the plugin is not a cloud service.

Successful exploitation of this stored XSS vulnerability could allow an attacker with high privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. This may lead to limited disclosure of information, modification of data, or disruption of service within the affected WordPress environment. However, the impact is considered medium severity due to the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted individuals only and consider disabling or replacing the affected plugin to mitigate risk.