The SEO Landing Page Generator WordPress plugin suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping of URL parameters. This flaw affects all versions up to 1.66.2 and enables unauthenticated attackers to inject malicious scripts that execute when a user clicks a manipulated link. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. No known exploits are reported in the wild, and no patch or remediation guidance is currently available from the vendor.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing attackers to steal session cookies, perform actions on behalf of the user, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no reported availability impact. The attack requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking links related to the SEO Landing Page Generator plugin and consider disabling or replacing the plugin if possible. Monitoring vendor channels for updates is recommended.