This vulnerability in 'Quantities and Units for WooCommerce' allows stored cross-site scripting due to improper input sanitization when generating web pages. An attacker with low privileges can inject malicious scripts that execute when other users view the affected content. The vulnerability affects all versions up to 1.0.13. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected pages, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The medium severity reflects these impacts but also the requirement for user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting plugin usage or applying temporary mitigations such as input validation or disabling vulnerable features. Monitor for vendor updates to apply an official patch once released.