The updated vulnerability description reveals a DOM‑based XSS flaw in the Email Inquiry & Cart Options for WooCommerce plugin caused by improper neutralization of user input during page generation. This flaw permits attackers to inject malicious JavaScript that executes in the browsers of site visitors, potentially leading to session hijacking, credential theft, or the display of deceptive content.

All installations of the Email Inquiry & Cart Options for WooCommerce plugin developed by Steve Truman that use version 3.4.3 or earlier, up to and including 3.5.0 are affected. The flaw exists from the initial release through 3.5.0.

The CVSS v3.1 base score is 6.5, indicating medium severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote—an attacker would exploit the flaw by having a user interact with a crafted request to the plugin’s inquiry or cart functionality. The description does not specify additional prerequisites, so the vulnerability likely requires victim interaction with a malicious link or input field that the plugin fails to sanitize.