The plugin contains a reflected XSS flaw that allows an attacker to inject unsanitized user input into the browser during page generation. An attacker can craft a malicious input that will be echoed back in the page and executed in the victim's browser session, potentially leading to session hijacking, defacement, or theft of credentials. This weakness is a classic input validation failure, identified as CWE‑79.

WordPress sites that have Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products installed in any version up to and including 1.0.1 are affected.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is below 1% indicating a low current exploitation probability, and the issue is not listed in CISA's KEV catalog. The likely attack vector is through the web interface where the plugin processes user input, such as URLs or form submissions that reflect data back to the page. If an attacker can deliver a crafted request to a vulnerable site, the referrer or query string gets rendered unsafely.