The plugin contains a DOM‑based XSS flaw caused by improper neutralization of user input during page generation. A malicious actor can inject JavaScript that runs in the victim’s browser, potentially enabling session hijacking, credential theft, or display of fraudulent content.

All installations of the Email Inquiry & Cart Options for WooCommerce plugin developed by Steve Truman that use version 3.4.3 or earlier are affected. The flaw exists from the initial release through 3.4.3.

The CVSS v3.1 base score is 6.5, indicating medium severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote—an attacker would exploit the flaw by having a user interact with a crafted request to the plugin’s inquiry or cart functionality. The description does not specify additional prerequisites, so the vulnerability likely requires victim interaction with a malicious link or input field that the plugin fails to sanitize.