CVE-2020-11727

The Advanced Order Export for WooCommerce plugin before version 3.1.4 contained a reflected cross-site scripting vulnerability in the woe_post_type parameter that failed to properly sanitize user input. An attacker could inject malicious HTML and JavaScript code that would execute within the browser of any authenticated user viewing the affected page. This flaw enabled arbitrary script execution in the security context of logged-in administrators or users.

Based on public CVE data (MITRE/NVD).