The ReDi Restaurant Reservation plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to the use of the add_query_arg function without proper escaping of URL parameters. This flaw exists in all versions up to and including 24.0902. An attacker can craft a malicious URL that injects arbitrary JavaScript code, which executes when a user clicks the link, potentially leading to session hijacking or other script-based attacks. The vulnerability is unauthenticated and requires user interaction (clicking a link). The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of user interactions on affected pages. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious links related to the affected plugin. Monitoring vendor channels for updates is recommended. No official fix or temporary workaround has been provided in the available data.