Administrator-browser script execution via unescaped page attribute

Reflected XSS in PI Web Solution Product Enquiry for WooCommerce before 3.2 allows remote attackers to run script in an administrator's browser. The plugin writes the unsanitized page POST parameter into an HTML attribute on the GMWQP enquiry-list admin page, allowing a crafted value to escape the attribute and inject script. Exploitation requires a logged-in administrator to open an attacker-controlled page that submits the crafted request; the script executes in the vulnerable site's administrative origin.