The PDF Thumbnail Generator plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to the use of add_query_arg without proper escaping of URL parameters. This flaw exists in all versions up to 1.3, allowing unauthenticated attackers to inject malicious scripts that execute when a user clicks a crafted link. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (Network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, no availability impact). No patch or official remediation has been documented in the provided data.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website for users who click on malicious links. This can result in limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no impact on system availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious links related to the PDF Thumbnail Generator plugin and consider disabling or removing the plugin if feasible. Monitor official kubiq communications for updates or patches addressing this vulnerability.