The reported vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, resulting in reflected cross‑site scripting. An attacker can embed malicious JavaScript in the query string that is subsequently reflected in the generated page, allowing the execution of code in the context of the victim’s browser. This can lead to session hijacking, disclosure of sensitive information, or defacement of the site and is identified by CWE‑79.

This flaw affects the WooCommerce Order Search plugin developed by Chetan Khandla. Versions from the initial release through and including 1.1.0 are impacted. Any WordPress site running this plugin before the release of a newer version is vulnerable.

The vulnerability carries a CVSS score of 7.1 and an EPSS score of less than 1%, indicating a low but non‑zero probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers would most likely exploit it by directing users to a specially crafted URL on an affected site; no special privilege or remote access is required, and the attack can be performed by a client‑side browser. If successful, it allows arbitrary script execution within the victim’s browser session.