The BuddyPress Docs WordPress plugin suffers from a reflected cross-site scripting vulnerability (CWE-79) due to the use of remove_query_arg without proper escaping on URLs. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability affects all versions up to 2.2.3. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially compromising user confidentiality and integrity. This could allow attackers to steal session tokens, perform actions on behalf of the user, or manipulate displayed content. However, exploitation requires user interaction (clicking a malicious link) and does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links related to BuddyPress Docs and consider disabling or limiting the plugin's use. Monitoring vendor channels for updates is recommended.