Improper neutralization of input during web page generation allows an attacker to inject arbitrary client‑side scripts via user‑controlled data into the Altima Lookbook Free for WooCommerce plugin. The vulnerability is a classic reflected XSS, potentially enabling session hijacking, defacement, or phishing attacks when a victim visits a crafted URL. The weakness resides in the plugin’s handling of query parameters or form fields without proper escaping, correlating with CWE‑79.

The Altima Lookbook Free for WooCommerce plugin developed by Altima‑Interactive, versions from the earliest release through 1.1.0, is affected. Users of any WordPress site installing this plugin version are exposed.

The CVSS score of 7.1 indicates a moderate‑to‑high severity flaw. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is web interaction with unsanitized plugin inputs, requiring a victim to view a maliciously crafted URL or form to trigger script execution.