The WordPress Brute Force Protection – Stop Brute Force Attacks plugin suffers from a reflected XSS vulnerability due to inadequate neutralization of input in URL query parameters. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping, enabling injection of malicious scripts. This vulnerability affects all versions up to 2.2.6 and can be exploited by unauthenticated attackers who can trick users into clicking malicious links, leading to script execution in the context of the victim's browser session.

Successful exploitation can lead to execution of arbitrary scripts in the context of a victim's browser, potentially resulting in theft of cookies, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or denial of service. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to the affected plugin and consider disabling or replacing the plugin if possible. Monitor the vendor's channels for updates or patches addressing this vulnerability.