Technical impact
A flaw in the WordPress WC MyParcel Belgium plugin allows reflected cross‑site scripting via improper neutralization of input during web page generation. If an attacker supplies malicious data that the plugin outputs without adequate escaping, the payload can execute in the browser of any user who views the affected page, enabling session theft, defacement, or redirection.
Affected Systems
The vulnerability affects the WC MyParcel Belgium plugin developed by Richard Perdaan. Versions 4.5.5 and the 4.5.5-beta release are impacted.
Risk and Exploitability
The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA's KEV catalog, and no publicly known active exploits have been reported. Likely attack vectors involve a crafted URL or form that the plugin renders; the exploit requires the attacker to entice a victim to visit the URL, making it a typical reflected XSS scenario.
EUVD