The Splash Sync plugin for WordPress suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping on URL parameters in all versions up to 2.0.7. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a maliciously crafted link. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation enables an attacker to execute arbitrary scripts in the context of the affected website for users who click on a malicious link. This can lead to information disclosure or manipulation of user interactions within the affected site. There is no indication of impact to availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links and consider disabling or restricting the Splash Sync plugin to reduce exposure.