An attacker can inject malicious JavaScript through the plugin’s web page rendering, because the plugin fails to neutralize user‑supplied input. The reflected XSS permits arbitrary script execution in the browser of any user who views the vulnerable page, enabling session hijacking, defacement, or theft of sensitive data controlled by the victim’s browser session. The vulnerability resides in the plugin’s handling of query parameters that are reflected back in the HTML output.

The vulnerability affects the WordPress plugin "Small Package Quotes – Unishippers Edition" provided by enituretechnology, all released versions up to and including 2.4.9. No other vendor or product versions are listed as affected.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is below 1%, indicating that the likelihood of exploitation at this time is low, and the issue is not listed in the CISA KEV catalog. Likely exploitation requires only a crafted URL, no authentication, and could target any WordPress site using the affected plugin. While the probability of exploitation is currently low, the impact of successful exploitation—browser‑level code execution—remains significant.