A stored cross-site scripting (XSS) vulnerability in the Cost of Goods by PixelYourSite plugin allows unauthenticated attackers to inject malicious scripts into the application.

The plugin fails to properly sanitize input in the 'csvdata[0][cost_of_goods_value]' parameter, resulting in a stored cross-site scripting (CWE-79) vulnerability. This allows an attacker to execute arbitrary scripts in the context of an administrator's browser session.

An attacker can use this XSS vulnerability to hijack administrator sessions, redirect users to malicious websites, or perform unauthorized administrative actions. This compromises the integrity of the WordPress site and places user and administrative data at risk. The CVSS score of 7.2 reflects the impact of stored XSS in an administrative context.

Immediate Action: Update the Cost of Goods by PixelYourSite plugin to version 1.2.13 or later immediately.

Proactive Monitoring: Monitor site traffic for unusual redirect patterns or attempts to inject script tags into plugin-related data fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious script injections in HTTP requests.

Public Exploit Available: No confirmed public exploit (e.g., Metasploit/ExploitDB) available in the provided data.

The vulnerability is addressed in version 1.2.13; all users must update immediately to mitigate the risk of XSS-based attacks. Failure to patch leaves the site susceptible to administrative session compromise and unauthorized actions.