The vulnerability is an instance of improper neutralization of user input during web page generation, allowing reflected XSS. It can be triggered when the plugin processes untrusted query parameters, leading to execution of arbitrary JavaScript in the context of the site, potentially compromising user sessions, defacing the site or installing malware.

This flaw affects Primer MyData for Woocommerce, version numbers from the earliest known up to 4.2.5, for all WordPress installations that use the plugin. The entry specifies no specific platform constraints beyond WordPress environment.

The CVSS score of 7.1 marks it as high severity, while the EPSS score of less than 1% indicates a low exploitation probability at this time; furthermore, the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a crafted URL delivered via email or hyperlink that an authenticated or unauthenticated user clicks, exploiting the lack of input sanitization to inject malicious scripts.