The GEO my WordPress plugin (versions <= 4.5.0.3) suffers from a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted web content. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or vendor advisory details are currently available.

Successful exploitation can allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, manipulation of web content, or disruption of availability. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted inputs and avoid clicking on suspicious links that could trigger reflected XSS. Monitor the vendor's communications for updates on patches or official mitigations.