The Conversios plugin for WordPress, used for Google Analytics (GA4), Google Ads, and conversion tracking, suffers from a reflected XSS vulnerability via the 'tiktok_user_id' parameter. This vulnerability arises from improper neutralization of input during web page generation (CWE-79). Attackers can inject malicious scripts that execute in the context of a victim's browser if the victim interacts with a maliciously crafted link. The vulnerability affects all versions up to 7.1.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no direct impact on availability. The attack requires user interaction (clicking a crafted link) and has a high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links involving the 'tiktok_user_id' parameter in affected versions of the plugin. Monitoring vendor channels for updates is recommended.