The Plus Addons for Elementor Page Builder Pro plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) in the 'forgoturl' attribute of its WP Login & Register widget. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. The issue affects all versions up to 5.5.6 and requires no privileges but user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other actions permitted by the victim's privileges in the affected site. The vulnerability does not impact availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory channels for updates. Until a fix is available, avoid clicking on suspicious links that may exploit this vulnerability and consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting the 'forgoturl' parameter.