The Listivo - Classified Ads WordPress Theme suffers from a reflected XSS vulnerability due to improper neutralization of user input in the 's' parameter. This allows attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The issue affects all versions up to 2.3.67. The CVSS 3.1 vector indicates the attack requires no privileges, has low attack complexity, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions limited to the user's session and browser context. There is no indication of direct impact on system availability or integrity beyond the affected user's session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the vulnerable 's' parameter or applying web application firewall (WAF) rules to detect and block suspicious input patterns related to this parameter. Avoid clicking on untrusted links that may exploit this vulnerability.