The StageShow WordPress plugin suffers from a reflected cross-site scripting vulnerability due to the use of remove_query_arg without proper escaping on URL parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser when they click a crafted link. The vulnerability affects all versions up to 9.8.6 and has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no vendor-provided patch or advisory available at this time, and no known active exploitation has been reported.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. The attack requires user interaction (clicking a malicious link) and does not affect system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the StageShow plugin or restricting its use. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor for vendor updates to apply any forthcoming patches promptly.