The vulnerability is an improper neutralization of input that enables a DOM‑based XSS attack. An attacker can inject malicious scripts into the generated web page, potentially leading to session hijacking, data exfiltration, or defacement of the site. The weakness is classified as CWE‑79.

The issue affects the WordPress e‑shops plugin (e‑shops-cart2) from any version through 1.0.4. Versions 1.0.4 or earlier are vulnerable, regardless of any patch applied after that point. The plugin is distributed by the vendor hands01, and it is a commercial or community‑based WordPress e‑commerce solution.

The CVSS score of 7.1 indicates a moderate to high risk when the vulnerability is exploitable. The EPSS score of less than 1% suggests that exploitation is currently rare or difficult. The flaw is not listed in CISA’s KEV catalog, and the typical attack vector is web‑based, with a malicious link or crafted input in a URL that the browser processes. In order to succeed the attacker needs access to an affected user’s browser; no special server‑side privileges are required.