The Booster for WooCommerce plugin used in WordPress has a security issue called Reflected Cross-Site Scripting. This happens because the plugin uses add_query_arg & remove_query_arg without protecting the URL properly. This enables attackers who are not logged in to insert harmful web scripts into pages that can run if they are able to deceive a user into taking an action, like clicking on a link.