The Ultimate WordPress Toolkit – WP Extended plugin versions up to 3.0.8 suffer from a reflected cross-site scripting vulnerability (CWE-79) via the 'page' parameter. This occurs due to improper neutralization of input during web page generation, allowing injection of malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The vulnerability is unauthenticated and requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially enabling theft of user credentials, session tokens, or other sensitive information accessible via the browser. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin or applying any recommended temporary mitigations from the vendor. Additionally, users should be cautious about clicking on suspicious links that could exploit this vulnerability.