The vulnerability is an improper neutralization of input that allows an attacker to inject malicious script into a reflected response. A victim who visits a crafted URL can have arbitrary client‑side code executed in their browser, leading to session hijacking, cookie theft, or defacement. The weakness is a classic reflected XSS (CWE‑79) and can affect any user able to complete the request.

The flaw exists in Primer MyData for WooCommerce plugin versions earlier than 4.2.4. Any WordPress site that has the plugin installed and running one of those versions is susceptible. The plugin developer is primersoftware and distributors should contact them for an update.

The CVSS base score of 7.1 classifies the issue as high severity. The EPSS score is under 1%, indicating a low but non‑zero exploitation probability, and the vulnerability is not yet listed in CISA KEV. Attackers can trigger the flaw by sending a malicious link to an unsuspecting user; once the victim clicks, the script is executed. The lack of server‑side validation or output sanitization is the fundamental failure.