The vulnerability is an unauthenticated stored XSS that occurs when a malicious value is submitted through the "zipcode" form field in the plugin’s setup wizard. Because the plugin does not sanitize or escape this value before storing it, any user who later views a page containing the stored value will have the injected script executed in their browser. The injected script can read document cookies, steal session tokens, or redirect users, providing an attacker with full session hijacking or phishing capabilities.

The affected product is the AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia for WordPress, versions up to and including 9.2.41. All installations of these versions that have the setup wizard enabled are vulnerable. The plugin is distributed through WordPress’s plugin repository and is commonly used on Indonesian e‑commerce sites.

The CVSS score of 7.2 indicates a high severity, and while an EPSS score is unavailable, the lack of required authentication makes the attack easily exploitable by anyone who can send an HTTP request to the setup wizard. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high impact and the nature of stored XSS mean that exploitation could lead to compromised user sessions and site defacement. The attacker would need only to access the plugin’s setup wizard endpoint, which is publicly reachable, to inject malicious payloads.