The 2D Tag Cloud plugin for WordPress suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping of URL parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute when a victim clicks a crafted link. The vulnerability affects all versions up to 6.0.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising user confidentiality and integrity. This may allow attackers to steal session tokens, perform actions on behalf of the user, or conduct phishing attacks. There is no impact on system availability. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with links received from untrusted sources. Site administrators may consider disabling or removing the 2D Tag Cloud plugin if feasible. Monitor official channels for updates or patches from the plugin developer.