The Automate Hub Free WordPress plugin by Sperse.IO suffers from a reflected XSS vulnerability (CWE-79) due to improper neutralization of input in the 'id' parameter. This flaw affects all versions up to 1.7.0 and allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of a victim's browser when they click a maliciously crafted link. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (Network attack vector, low attack complexity, no privileges required, requires user interaction, impacts confidentiality and integrity). No patch or official remediation has been published by the vendor as of the data provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of sensitive information or session hijacking. The vulnerability does not impact availability. Since exploitation requires user interaction and no privileges, it poses a moderate risk. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'id' parameter in affected plugin versions. Consider disabling or removing the plugin if possible to mitigate risk. Monitor for vendor updates regarding patches or official fixes.