The Tax Report for WooCommerce plugin suffers from an Improper Neutralization of Input During Web Page Generation, enabling reflected XSS. The flaw allows an attacker to inject and execute arbitrary client‑side scripts in the victim’s browser when a crafted request is processed. This can lead to credential theft, session hijacking, defacement, or deceptive phishing interactions. The weakness corresponds to CWE‑79.

WordPress sites that have installed the Tax Report for WooCommerce plugin by infosoftplugin with any version up to and including 2.2 are vulnerable. No newer version is documented as mitigating this issue in the CVE data.

The CVSS score of 7.1 marks the flaw as high severity, while the EPSS score of less than 1 % indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating a specially crafted URL or form input that injects malicious payloads, which are then reflected in the page output and executed by the victim’s browser. The vulnerability does not provide remote code execution or direct server compromise; it relies on user interaction or the presence of vulnerable rendering logic within the plugin.