The motovnet Ebook Store WordPress plugin versions up to 5.8001 suffer from a reflected cross-site scripting vulnerability (CWE-79) due to the use of add_query_arg without proper escaping of URL parameters. This flaw enables unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or vendor advisory is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website for users who click on crafted links. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no impact on system availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with links related to the Ebook Store plugin and consider disabling or removing the plugin if possible. Monitor official motovnet or WordPress plugin sources for updates or patches addressing this vulnerability.