This vulnerability in pco_58 WC Return products (versions up to 1.5) is caused by improper neutralization of input during web page generation, leading to reflected Cross-site Scripting (XSS). The flaw allows an attacker to inject malicious scripts that execute in the context of a victim's browser when they interact with crafted web content. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system or user data. The reflected nature means the attack requires the victim to interact with a crafted link or page.

No official patch or remediation guidance is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. Until a fix is released, cautious handling of untrusted input and limiting exposure to untrusted links may reduce risk.