This vulnerability in NikanWP WooCommerce Reporting (<= 1.0.0) arises from a CSRF issue that permits stored XSS attacks. An attacker could exploit this by tricking an authenticated user into submitting a crafted request, resulting in malicious script storage and execution within the application. The vulnerability affects the wc-reports-lite component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation could lead to stored XSS, allowing attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, data manipulation, or other malicious activities. The CSRF aspect means attackers can induce authenticated users to perform unwanted actions. The overall impact affects confidentiality, integrity, and availability at a low level but is significant due to the stored XSS nature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin version. Implementing standard CSRF protections and input sanitization may reduce risk but are not confirmed mitigations for this issue.