This vulnerability is an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) flaw that allows attackers to inject malicious scripts into pages rendered by the WordPress Woocommerce osCommerce Sync plugin. An attacker could use the reflected XSS to execute arbitrary JavaScript in the context of a victim’s browser, potentially leading to session hijacking, defacement or the execution of further malicious code. The weakness is identified as CWE‑79, indicating that user-supplied data is not properly sanitized before being included in the HTML output.

Vulnerable versions of the WooCommerce osCommerce Sync plugin from the initial release up through 2.0.20, developed by Alejandro Aranda, are affected. The issue is present in the WordPress environment where the plugin is installed, and applies to all instances of the plugin running these versions.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, while the EPSS score of less than 1 % suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the bug by crafting a URL or input that the plugin reflects unescaped, a typical reflected XSS scenario.