The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to 3.0.8 suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'selected_option' parameter. This flaw is due to improper neutralization of input during web page generation, allowing injection of arbitrary web scripts. The vulnerability can be triggered by unauthenticated attackers who can trick users into clicking malicious links, leading to execution of injected scripts in the context of the victim's browser session. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser session when the victim interacts with a crafted link. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of displayed content. There is no impact on system availability. The vulnerability affects all versions of the plugin up to and including 3.0.8. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or applying any recommended temporary mitigations from the vendor. Additionally, exercising caution with untrusted links can reduce risk. Monitor the vendor's communications for updates on patches or official fixes.