The WP on AWS plugin for WordPress versions up to and including 5.2.1 suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape $_POST data, enabling attackers to inject arbitrary web scripts. This vulnerability can be exploited without authentication but requires user interaction (clicking a malicious link). The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability does not affect availability. No known exploits in the wild have been reported at this time.

A patch is available for this vulnerability. Users of the WP on AWS plugin should update to the latest version beyond 5.2.1 where the issue is fixed. Until patched, users should exercise caution with links and inputs related to the plugin. No vendor advisory content was provided, so verify the patch availability and update instructions from the official wpseahorse sources.