The Loggedin – Limit Active Logins WordPress plugin suffers from a reflected cross-site scripting vulnerability (CWE-79) due to the use of add_query_arg without proper escaping of URL parameters. This allows unauthenticated attackers to inject arbitrary JavaScript code that executes in the context of a victim's browser if they are tricked into clicking a malicious link. The vulnerability is present in all versions up to and including 1.3.1 and is only exploitable when the 'leave a review' notice is displayed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible via the browser. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and presence of the 'leave a review' notice, reducing the attack surface. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the 'leave a review' notice or removing the plugin if feasible to mitigate exposure. Additionally, users should be cautious about clicking unsolicited links related to affected sites. Monitor the plugin's official channels for updates or patches addressing this vulnerability.