The vulnerability arises from the failure to escape user input before rendering it back in a webpage, enabling attackers to inject malicious scripts that run under the victim's browser context. This flaw is identified as a CWE‑79 type and can result in session hijacking, cookie theft, defacement, or the execution of arbitrary client‑side commands. The impact is limited to the scope of the web application and the privileges of the compromised user, but it can undermine the confidentiality and integrity of the site’s data and user experience.

The affected product is the Small Package Quotes – Worldwide Express Edition plugin developed by enituretechnology. Versions from the initial release through and including 5.2.18 are vulnerable. All installations that rely on these versions are at risk until the plugin is updated to a fixed release.

The CVSS base score of 7.1 indicates a medium severity. The EPSS score of less than 1% suggests that exploitation attempts are rare but not impossible. The vulnerability is not listed in KISA's KEV catalog, reducing the likelihood of widespread exploitation. The likely attack vector is a reflected request sent via a crafted URL or form that includes the unescaped input, which an attacker can trigger manually or embed in malicious content.