This vulnerability in the Quantities and Units for WooCommerce plugin allows an attacker with low privileges and requiring user interaction to inject and store malicious scripts due to improper input neutralization during web page generation. The stored XSS can lead to cross-site scripting attacks that affect confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to 1.0.13. No cloud service is involved, and no known exploits are reported in the wild. The CVSS 3.1 base score is 6.5, indicating a medium severity.

Successful exploitation of this stored XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of sensitive information, session hijacking, or manipulation of site content. The CVSS vector indicates limited confidentiality, integrity, and availability impacts. The vulnerability requires some privileges and user interaction, which limits the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, consider restricting user input capabilities and applying web application firewall (WAF) rules to detect and block XSS payloads relevant to this plugin.