This vulnerability in VillaTheme Email Template Customizer for WooCommerce (up to version 1.2.17) involves improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) issue. An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 5.9, reflecting a medium severity level. There is no vendor advisory or patch information provided at this time.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium due to the requirement for high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrative access to trusted users only and exercise caution when interacting with email templates. Monitor for updates from VillaTheme regarding patches or mitigations.