The Newsletter Subscriptions WordPress plugin by hanif-khan suffers from a reflected XSS vulnerability (CWE-79) via the 'token_type' parameter. This flaw is due to improper input neutralization during web page generation, allowing injection of malicious scripts that execute when a user interacts with a crafted URL. The vulnerability affects all versions up to 2.1. The CVSS 3.1 score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no availability impact. Since the attack requires user interaction, the risk is mitigated somewhat by user caution. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the vulnerable plugin or restricting access to affected functionality. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor official hanif-khan or WordPress plugin sources for updates and apply patches promptly once released.