Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the codisto Omnichannel for WooCommerce plugin (versions up to 1.3.65). It allows attackers to inject malicious scripts, such as redirects or advertisements, that execute when site visitors access compromised pages. The attack can be initiated by an unauthenticated user but requires user interaction by a privileged user to execute. [1]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to malicious scripts running in the context of the affected website, potentially redirecting users, displaying unwanted advertisements, or executing other harmful HTML payloads. This can compromise user trust, lead to data theft, or facilitate further attacks. The vulnerability is considered medium severity with a CVSS score of 7.1 and is expected to be actively exploited if unmitigated. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring for suspicious input or script injections in web pages generated by the Omnichannel for WooCommerce plugin up to version 1.3.65. Since this is a Stored XSS vulnerability, look for unexpected HTML or JavaScript code in user-generated content or input fields. Specific commands are not provided in the resources, but you can use web vulnerability scanners or manual inspection tools to identify injected scripts. Additionally, monitoring HTTP requests and responses for suspicious payloads targeting the plugin may help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the Patchstack mitigation rule provided to block attacks targeting this vulnerability until an official patch is released. Users should implement this mitigation immediately to protect their websites. Avoid allowing privileged users to interact with untrusted inputs, and monitor for suspicious activity. Since no official patch is available as of January 15, 2026, applying the mitigation rule is the recommended immediate action. [1]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not specify how this Cross-site Scripting (XSS) vulnerability in the Omnichannel for WooCommerce plugin affects compliance with standards such as GDPR or HIPAA.

Useful 0 Not Useful 0