Flexible Refund and Return Order for WooCommerce vulnerabilities

The Flexible Refund and Return Order for WooCommerce plugin up to version 1.0.51 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.