Advanced Order Export EUVD-2026-39379

Exploitation requires that a victim - typically a store administrator - open the plugin's order export or preview page that renders the attacker-supplied order field (UI:R, user interaction is mandatory). The attacker must be able to introduce malicious data into an exported order field, which in a WooCommerce storefront means submitting a crafted order or order detail at checkout; the Patchstack 'Customer' classification indicates a customer-level vantage point is the realistic entry. Limiting factors: the payload only triggers when an admin views the affected export/preview view, impact is constrained to script execution in the browser (low C/I/A), and the store must be running Advanced Order Export For WooCommerce 4.0.9 or earlier. The provided vector states PR:N, but the practical prerequisite of placing order data should be weighed when assessing realistic risk.

Signals are moderate and partly inferential. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network reach, low complexity, no privileges, but mandatory user interaction, with low confidentiality/integrity/availability impact amplified by a scope change to 7.1. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation pressure appears low and opportunistic rather than mass-exploited. Note a tension worth verifying: Patchstack labels this 'Customer' XSS, which usually implies the injection is performed by a customer-level actor, yet the vector states PR:N (unauthenticated); the practical attacker is likely a customer submitting malicious order data, with the script later executing in a privileged admin context. This is a real-but-not-urgent priority - patch in normal cadence rather than emergency, as no evidence of active exploitation exists.

An attacker places a WooCommerce order (or submits order data) embedding a malicious JavaScript payload in a field such as billing name, address, or order note. When a store administrator later opens the plugin's order export or preview screen, the unsanitized payload renders and executes in the admin's authenticated browser session, potentially performing actions as that admin. No public POC was provided, but the low attack complexity makes opportunistic injection straightforward.