This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin, versions up to 2.10.0. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks, potentially leading to partial compromise of user confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low complexity, no privileges required, user interaction required, and scope changed, with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects users interacting with the vulnerable WooCommerce plugin, potentially compromising their data or session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as input validation or output encoding where possible. Monitor vendor channels for updates and apply patches promptly once available.