The Gantry 4 Framework plugin for WordPress suffers from a reflected cross-site scripting vulnerability via the 'override_id' parameter due to improper input neutralization. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. The issue affects all versions up to 4.1.21. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially enabling theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction and does not affect system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the Gantry 4 Framework plugin or applying web application firewall (WAF) rules to block malicious input targeting the 'override_id' parameter. Avoid clicking on suspicious links that could exploit this vulnerability.