The G Web Pro Store Locator plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input in the 'q' parameter. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they click on a specially crafted link. The vulnerability affects all versions up to and including 2.1. The CVSS 3.1 vector indicates the attack requires no privileges, has low attack complexity, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session hijacking. The vulnerability does not affect system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on links involving the 'q' parameter in affected versions. Consider disabling or removing the plugin if possible or applying web application firewall rules to block suspicious input patterns targeting the 'q' parameter.