This vulnerability is an improper neutralization of input during web page generation in the GLS Shipping for WooCommerce plugin. The flaw allows reflected cross‑site scripting, meaning that attackers can supply malicious input that is echoed back to a user’s browser. As a result, arbitrary client‑side code can execute in the context of a legitimate visitor to the site.

The affected product is GLS Shipping for WooCommerce, all versions from the earliest release up to and including version 1.4.0. Any WordPress site that has an instance of the plugin within that version range is potentially vulnerable.

The CVSS score of 7.1 indicates a high severity for this reflected XSS flaw. The EPSS score of <1% shows a very low probability of widespread exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV. Based on the description, exploitation would likely require a victim to be presented with a crafted input or link that triggers the reflected script execution in a standard web browser.