The Customer Reviews Collector for WooCommerce plugin contains a reflected cross‑site scripting flaw caused by insufficient sanitization of the "email‑text" parameter. An attacker can inject arbitrary JavaScript that is reflected back in the page when a user follows a crafted link or submits a form, allowing the malicious script to execute in the victim’s browser.

The flaw affects all installations of the trustindex Customer Reviews Collector for WooCommerce plugin on WordPress up to and including version 4.6.1. Any site running a vulnerable version and exposing the "email‑text" parameter may be impacted.

The severity is indicated by a CVSS score of 6.1, suggesting a moderate risk. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to lure a user to the vulnerable page via a malicious link or form that includes the unescaped "email‑text" value, with no privileged access required.