This vulnerability is a DOM-based cross-site scripting (XSS) flaw in the Email Inquiry & Cart Options for WooCommerce plugin by Steve Truman. It arises from improper neutralization of input during web page generation, allowing malicious scripts to be executed in the context of the victim's browser. The affected versions include all versions up to 3.5.0. The CVSS score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim user, potentially leading to partial disclosure of information, modification of data, or disruption of service. The attack requires the attacker to have low privileges and the victim to interact with malicious content. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting user input or applying web application firewall rules to mitigate potential exploitation.