The vulnerability is an improper neutralization of input during page generation, allowing a reflected XSS. An attacker can inject malicious JavaScript through crafted requests, executing code in a victim’s browser. This can lead to session hijacking, phishing, or defacement, and the weakness is labeled CWE‑79.

WordPress plugin ‘Plugin Oficial – Getnet para WooCommerce’ from vendor lisandragetnet is affected for all versions up to and including 1.7.3. No other products or vendor versions are listed.

The CVSS score of 7.1 indicates high severity for client‑side attacks, while the EPSS score of < 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by crafting a URL or form that embeds malicious input; the plugin then reflects this input back to the browser, impacting the victim’s session while requiring no persistence on the server.