The Media Library Folders WordPress plugin suffers from a reflected XSS vulnerability (CWE-79) via the 's' parameter due to improper input neutralization during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if they interact with a crafted URL. The issue affects all versions up to 8.2.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially enabling theft of session tokens, user impersonation, or other actions permitted by the victim's privileges within the affected site. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the Media Library Folders plugin or applying web application firewall (WAF) rules to filter malicious input targeting the 's' parameter. Monitor vendor channels for updates and apply patches promptly once released.