The AWSA Shipping plugin for WordPress contains a reflected cross‑site scripting flaw. Input from users is reflected back to the web page without proper sanitization, allowing an attacker to inject malicious JavaScript via crafted URLs. The injected code can execute in the victim’s browser, enabling actions such as session hijacking, data theft, or site defacement. This weakness aligns with CWE‑79, a typical client‑side injection vulnerability.

Any WordPress installation running Sajjad Aslani’s AWSA Shipping plugin from its earliest released version up through 1.3.0 is vulnerable. Sites using earlier versions of the plugin are also at risk, although the exact earliest affected version is unspecified.

The CVSS v3.1 score of 7.1 denotes a high‑severity risk. The EPSS score of less than 1% indicates that mass exploitation is unlikely, yet the presence of the flaw means it can be easily leveraged by a determined attacker. The vulnerability is not listed in CISA’s KEV catalog. Exploitation demands the victim to visit a URL containing malicious payloads, and does not require privileged authentication.