The FormFacade WordPress plugin for embedding Google Forms is vulnerable to reflected XSS via the 'userId' and 'publishId' parameters due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the victim's browser session if the victim interacts with a maliciously crafted URL. The vulnerability affects all plugin versions up to 1.3.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions limited to the user's session and browser context. The vulnerability does not impact availability and requires user interaction to exploit. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'userId' and 'publishId' parameters in this plugin. Consider disabling or removing the plugin if possible or restricting access to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.