CVE-2026-104313 describes a reflected cross-site scripting vulnerability in the WPC Estimated Delivery Date for WooCommerce plugin for WordPress. The flaw exists in the handling of the 'rule_data' parameter, which lacks proper sanitization and escaping, enabling attackers to inject malicious scripts. This affects all plugin versions from 0 up to and including 4.0.1. Exploitation requires user interaction, such as clicking a malicious link, and can lead to script execution in the context of the affected site.

Successful exploitation can lead to the execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure or session hijacking. The vulnerability requires user interaction and does not grant direct system access or denial of service. The CVSS score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid clicking suspicious links related to the affected plugin and consider disabling or removing the plugin if feasible. Implementing web application firewall (WAF) rules to detect and block XSS attempts targeting the 'rule_data' parameter may provide temporary mitigation.