This vulnerability is a CWE-79 type improper input neutralization issue in the Shipment Tracker for Woocommerce plugin, specifically in versions <= 1.5.3.2. It allows a subscriber-level user to inject malicious scripts that could be executed in the context of other users, leading to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with subscriber privileges to perform cross-site scripting attacks, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and privileges at the subscriber level, limiting the attack scope but still posing a risk to users and data within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit subscriber privileges where possible and monitor for suspicious activity related to web input handling. Avoid clicking on untrusted links or inputs within the affected plugin context.