The Product Delivery Date for WooCommerce – Lite plugin for WordPress suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping of URL parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when the victim interacts with a crafted URL containing malicious payloads. The vulnerability is present in all versions up to 2.7.3 and is only exploitable when notices are displayed on the page. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens. The impact affects confidentiality and integrity but does not affect availability. The attack requires user interaction (clicking a malicious link) and is limited to scenarios where notices are present on the page.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, administrators should consider disabling or limiting the use of the affected plugin, especially in environments where notices are displayed. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor vendor channels for an official patch or update.