The askewbrook Bing Search API Integration (abbs-bing-search) up to version 0.3.3 suffers from a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker to craft malicious input that is reflected in the web page without proper sanitization, potentially executing arbitrary scripts in the victim's browser. The CVSS 3.1 base score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The impact is rated as low on confidentiality, integrity, and availability, but the overall severity is high due to ease of exploitation and scope change. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider implementing input validation and output encoding on the affected integration to mitigate reflected XSS risks. Avoid exposing the vulnerable component to untrusted input where possible.