The GST for WooCommerce plugin contains a critical CSRF vulnerability that enables Stored XSS, potentially allowing unauthenticated attackers to execute malicious scripts in a user browser.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that allows an attacker to trick an authenticated user into performing unintended actions, resulting in Stored XSS. The vulnerability does not require prior authentication by the attacker to initiate the request, as it relies on the victim interacting with a malicious link or site.

The exploitation of this vulnerability can lead to the theft of session cookies, unauthorized administrative actions, or the redirection of users to malicious websites. With a CVSS score of 7.1, this represents a high risk to the integrity and confidentiality of the WooCommerce environment and its users. Persistent XSS within an e-commerce plugin poses a significant threat to customer data and overall platform reputation.

Immediate Action: There is currently no confirmed patch available; users should disable or remove the GST for WooCommerce plugin until the developer releases a secure version.

Proactive Monitoring: Security teams should monitor web server logs for suspicious POST requests originating from unexpected referrers that target the plugin configuration endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common CSRF and XSS patterns to provide a virtual layer of protection until the software is updated.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for Stored XSS, organizations currently utilizing the GST for WooCommerce plugin must treat this as a priority issue. Immediate deactivation of the affected component is the only reliable method to mitigate risk until the vendor provides a verified security patch.