The CVSS and EPSS scores for CVE-2026-66460 are misleading you. This isn't a routine medium-severity XSS that can wait for a scheduled patch cycle—the subscriber execution context fundamentally changes the threat model in ways these scores don't capture.
AfterShip Tracking exposes a subscriber-facing tracking lookup form. This is the attack surface: a malicious actor registers an account (WordPress registration is open by default on most deployments), enters a crafted tracking number containing a JavaScript payload, and that payload renders when support staff, admins, or operators view the tracking results. The victim set isn't a single admin session—it's everyone in the order management and customer service workflow who touches that tracking entry. One payload ricochets across multiple sessions.
Here's what makes this urgent: the notification pathway. AfterShip Tracking sends email and dashboard notifications when tracking status updates. If the XSS payload survives into those notifications—which often render HTML for formatting—the victim doesn't even need to visit the web interface. They open an email and the script executes. That's a delivery mechanism pure CVSS scope analysis ignores.
The EPSS score of 0.00211 reflects low bot-scanning probability, not low exploitation value. Subscriber XSS in high-install-count WordPress plugins (AfterShip has 30,000+ active installations) follows a documented pattern: attackers add it to wordlists for sustained campaigns targeting the long tail of unpatched sites 6-18 months post-disclosure. The 2018-2019 cluster of WooCommerce and Yoast vulnerabilities exploited exactly this trust boundary. Attackers remember this; the institutional memory on the defender side has degraded.
What to do now: disable open registration if your deployment allows it, or restrict the tracking lookup form to authenticated users with elevated privileges. Treat any subscriber-submitted tracking data as untrusted input regardless of authentication status. If the plugin offers input sanitization settings, verify they're enabled—peripheral features in purpose-built tools get less security scrutiny, and this form likely arrived as feature creep rather than core functionality. Patch rapidly. The barrier to exploitation is lower than the severity score suggests.