This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Pie Forms — Drag & Drop Form Builder plugin for WordPress. Specifically, the 'page' parameter is vulnerable to reflected cross-site scripting due to lack of sufficient sanitization and escaping. An attacker can craft a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the context of the affected site. The vulnerability affects all versions up to and including 1.4.19. The CVSS 3.1 base score is 6.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website via the 'page' parameter. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or limiting use of the affected plugin. Employing web application firewalls (WAF) with XSS protections may help mitigate exploitation attempts. Monitor official genetechproducts communications for updates on patches or official fixes.