The 'Price by Quantity & Bulk Quantity Discounts for WooCommerce' plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in URL parameters handled by add_query_arg. This vulnerability affects all versions up to 3.8.0. Because the plugin does not properly escape user-supplied input in the URL, attackers can inject arbitrary scripts that execute in the context of the victim's browser when they click a maliciously crafted link. The vulnerability is unauthenticated and requires user interaction. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, which can lead to limited disclosure or manipulation of information accessible to the victim's browser session. This may result in theft of cookies, session tokens, or other sensitive data, and could enable actions on behalf of the user within the affected site context. There is no impact on availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources. Consider disabling or removing the affected plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.