The UserFeedback WordPress plugin by smub suffers from a stored cross-site scripting vulnerability (CWE-79) in the handling of the 'page_submitted' 'link' parameter. Due to improper neutralization of input during web page generation, attackers can inject malicious scripts that persist in the feedback submission page. Execution of these scripts occurs when a user interacts with the injected link under specific conditions (clicking while pressing the command key). This vulnerability affects all plugin versions up to 1.0.13 and requires no privileges to exploit. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact.

An unauthenticated attacker can inject persistent malicious scripts into the feedback submission page, which execute in the context of users who click the crafted link while pressing the command key. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens within the affected plugin's context. There is no reported impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.