The vulnerability is an improper neutralization of browser input during page generation, classified as a reflected cross‑site scripting flaw. An attacker can inject and execute malicious JavaScript in the context of the victim’s browser, allowing for credential theft, session hijacking, or defacement. The weakness corresponds to CWE‑79 and is generally exploitable without authentication, relying on crafted URLs or form parameters.

The issue affects the Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin, version ranges from the earliest released build through 2.2 inclusive. WordPress sites that have installed any of these releases and expose the vulnerable input paths are inherently at risk.

With a CVSS score of 7.1 this vulnerability is considered high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the current landscape, and it is not listed in the CISA KEV catalog. Nevertheless, attackers can launch the exploit by directing a victim to a manipulated URL or form that contains malicious script payloads; the impact is confined to the victim’s browser session.