Improper neutralization of user‑supplied input during web page generation allows reflected XSS. An attacker could embed malicious scripts in a URL or form field that, when processed by the plugin, execute in the browser of anyone who clicks the crafted link or submits the form. This can lead to credential theft, session hijacking, defacement, or the execution of arbitrary JavaScript in the victim’s context. The weakness is a classic input‑validation flaw—CWE‑79.

This issue affects WordPress sites that use the "Radio Buttons and Swatches for WooCommerce" plugin from oneteamsoftware. All versions up to and including 1.1.20 are vulnerable; newer releases are not impacted.

The CVSS v3.1 base score is 7.1, indicating a high‑severity vulnerability. The EPSS score is < 1 %, so the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the described reflected nature and typical web‑application entry points, the most likely attack vector is via a maliciously crafted URL or form submission that an unsuspecting user follows or submits. The attack requires user interaction with the target site but can be automated if an attacker can load the crafted request.