The Ashwani kumar GST for WooCommerce plugin version 2.0 and earlier contains a CSRF vulnerability that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a crafted request, resulting in malicious scripts being stored and executed in the context of the affected site. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The vulnerability impacts confidentiality, integrity, and availability at a low level.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected website. This can compromise user data confidentiality, integrity, and availability of the affected WooCommerce GST plugin functionality. The vulnerability requires user interaction but no privileges, making it a significant risk for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin to mitigate risk. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.