The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress suffers from a reflected cross-site scripting vulnerability via the 'tab' parameter. This occurs because the plugin does not properly sanitize or escape input before including it in web pages. An unauthenticated attacker can exploit this by crafting a URL containing malicious script code in the 'tab' parameter and convincing a user to click it, resulting in script execution within the victim's browser context. This vulnerability affects all plugin versions up to and including 1.2.1. No known exploits in the wild have been reported, and no patch or official fix has been documented as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website for users who click a maliciously crafted link. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no impact on availability. The vulnerability requires user interaction (clicking a link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links containing the 'tab' parameter in the Feedpress Generator plugin. Consider disabling or removing the plugin if possible, or applying custom input sanitization and output escaping as a temporary mitigation.