A flaw in the WordPress WC MyParcel Belgium plugin allows reflected cross‑site scripting via improper neutralization of input during web page generation. If an attacker supplies malicious data that the plugin outputs without adequate escaping, the payload can execute in the browser of any user who views the affected page, enabling session theft, defacement, or redirection.

The vulnerability affects the WC MyParcel Belgium plugin developed by Richard Perdaan. Versions 4.5.5 and the 4.5.5-beta release are impacted.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA's KEV catalog, and no publicly known active exploits have been reported. Likely attack vectors involve a crafted URL or form that the plugin renders; the exploit requires the attacker to entice a victim to visit the URL, making it a typical reflected XSS scenario.