The Booster for WooCommerce plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, which can be manipulated by unauthenticated attackers to inject arbitrary web scripts. This vulnerability affects all versions up to and including 7.2.3. Successful exploitation requires user interaction, such as clicking a maliciously crafted link, which then executes the injected script in the context of the affected site.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of the affected website for users who click on a malicious link. This can lead to theft of user credentials, session hijacking, or other actions performed with the user's privileges. The impact is limited to confidentiality and integrity as indicated by the CVSS vector, with no direct availability impact. Since the attacker is unauthenticated, the attack surface is broad but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources. Consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Monitor for updates from the vendor and apply patches promptly once available.