The SKU Generator for WooCommerce plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) due to the use of add_query_arg without proper escaping of URL parameters in all versions up to 1.6.2. This flaw enables unauthenticated attackers to inject malicious scripts into web pages, which execute when a victim interacts with a specially crafted URL. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no reported impact on system availability. The vulnerability requires user interaction (clicking a malicious link) and affects the scope of the web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the SKU Generator for WooCommerce plugin and consider disabling or removing the plugin if possible. Monitoring vendor channels for updates is recommended.