The Archivist – Custom Archive Templates plugin for WordPress suffers from a reflected XSS vulnerability via the 'shortcode_attributes' parameter in versions up to 1.7.5. This occurs because input is not properly neutralized during web page generation, enabling attackers to inject arbitrary scripts that execute when a user is tricked into clicking a malicious link. The vulnerability is unauthenticated and affects all installations using the vulnerable versions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can inject and execute arbitrary JavaScript in the context of a victim's browser by exploiting the reflected XSS vulnerability. This can lead to theft of user session data, defacement, or other malicious actions limited to the user's browser context. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication. There is no indication of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the vulnerable plugin or applying web application firewall rules to block malicious input targeting the 'shortcode_attributes' parameter. Avoid clicking suspicious links that may exploit this vulnerability.