The Hero Mega Menu - Responsive WordPress Menu Plugin suffers from a reflected XSS vulnerability via the 'index' parameter due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The issue affects all plugin versions up to and including 1.16.5. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the victim's browser session when the victim clicks a malicious link. This could lead to theft of sensitive information, session hijacking, or other client-side attacks. There is no indication of direct impact on server availability or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the affected plugin or applying web application firewall (WAF) rules to block malicious input targeting the 'index' parameter. Avoid clicking on suspicious links that could trigger the vulnerability.