The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages WordPress plugin suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping of URL parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a crafted link. The vulnerability affects all plugin versions up to and including 1.7.6. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected site within a user's browser. This can lead to theft of sensitive information, session hijacking, or other malicious actions limited to the user's session. There is no indication of impact on availability. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid clicking suspicious links related to the affected plugin. Site administrators should monitor for updates from fatcatapps and apply any official fixes promptly. No official fix or temporary workaround is currently documented in the provided data.