The WP Media Optimizer (.webp) plugin for WordPress versions up to 1.4.0 contains a reflected cross-site scripting vulnerability (CWE-79) via the 'wpmowebp-css-resources' and 'wpmowebp-js-resources' parameters. Due to inadequate input validation and output encoding, attackers can inject malicious scripts that execute in the context of a victim's browser when they click on a crafted link. This vulnerability requires no privileges but does require user interaction. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity with no impact on availability. There is currently no vendor-provided patch or advisory detailing remediation.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session on sites using the vulnerable plugin. This can lead to information disclosure or manipulation of user interactions within the affected site. The vulnerability does not impact system availability and has a limited impact on confidentiality and integrity as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Media Optimizer (.webp) plugin if feasible. Additionally, avoid clicking on suspicious links that may exploit the vulnerable parameters. Monitor official francescosganga plugin channels for updates and apply any forthcoming patches promptly.