The WooCommerce Estimate and Quote plugin from cscode suffers from improper neutralization of user input during web page generation, a classic Cross‑Site Scripting weakness (CWE‑79). This flaw allows reflected XSS: an attacker can inject scripts that will execute in a victim’s browser when a crafted URL or form input is processed by the plugin, potentially leading to data theft, session hijacking, or defacement. The impact is limited to the victim’s session and browser but can enable credential theft and lateral movement if the user is an administrator.

The vulnerability affects the WooCommerce Estimate and Quote plugin for WordPress, any installation using versions from unspecified previous releases through and including 1.0.2.5. No other vendors or versions are listed as affected.

The CVSS score is 7.1, indicating moderate severity, while the EPSS score is below 1%, showing a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to entice a victim to visit a crafted URL or submit a malicious input that the plugin reflects without sanitization. Though the risk is medium, the low exploitation likelihood does not preclude the need for timely remediation.