The AutomatorWP plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in the 'a-0-o-search_field_value' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted link. The vulnerability affects all versions up to 5.0.9. Additionally, leveraging the plugin's import and code action features can escalate the impact to arbitrary code execution. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation can lead to arbitrary script execution in the context of the victim's browser, potentially resulting in session hijacking, data theft, or other malicious actions. When combined with the plugin's import and code action features, the impact extends to arbitrary code execution on the affected system. The vulnerability requires user interaction but no authentication, making it a critical risk for sites using vulnerable versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or restricting access to affected features to mitigate risk. Avoid clicking on suspicious links that could exploit this vulnerability. Monitor official rubengc or AutomatorWP channels for updates and apply any released fixes promptly.