An unauthenticated Cross‑Site Scripting flaw exists in the WordPress Product Enquiry for WooCommerce plugin for versions 2.2.34.43 and earlier. The vulnerability allows an attacker to inject arbitrary JavaScript into pages generated by the plugin. The injected script executes with the privileges of each visitor’s browser when the affected page is viewed, enabling malicious code to run in the user’s context.

The flaw impacts WordPress sites that have installed the Product Enquiry for WooCommerce plugin from PI Web Solution version 2.2.34.43 or older. Any deployment of those plugin versions on a WordPress installation is at risk.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests exploitation has not become widespread. The vulnerability does not require an authenticated session and can be triggered simply by accessing a crafted URL or submitting a form that the plugin processes. It is not listed in the CISA Known Exploited Vulnerabilities catalog, so no confirmed active attacks have been reported, but the attack vector remains available to any visitor of an affected page. Based on the description, it is inferred that an attacker could trigger the XSS by sending a malicious link or form payload to the plugin, however this specific attack vector was not explicitly detailed in the input.