The Smoove connector for Elementor forms plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to the use of add_query_arg without proper escaping of URL parameters. This flaw exists in all versions up to and including 4.1.0. An attacker can craft a malicious URL that injects arbitrary web scripts, which execute when a user clicks the link, potentially leading to information disclosure or session hijacking. The vulnerability is unauthenticated and requires user interaction. The CVSS 3.1 base score is 6.1 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser via a crafted URL. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on system availability. The vulnerability requires user interaction (clicking a malicious link) and affects all versions up to 4.1.0 of the plugin. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to the affected plugin and consider disabling or removing the Smoove connector for Elementor forms plugin if it is not essential. Monitor the vendor's official channels for updates regarding patches or mitigations.