This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in the Customize My Account for WooCommerce plugin. It allows unauthenticated attackers to perform cross-site scripting attacks, potentially leading to execution of arbitrary scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. Since the vulnerability is unauthenticated, it can be exploited by remote attackers without credentials. The user interaction requirement means the victim must interact with a crafted link or page to trigger the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling or restricting the affected plugin, implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin, and educating users to avoid interacting with suspicious links related to the affected functionality.