The Bounce Handler MailPoet 3 WordPress plugin suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'page' parameter due to inadequate input validation and output escaping. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a user's browser when they interact with a crafted URL. The vulnerability affects all versions up to 1.3.21. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No patch or official remediation guidance is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected user's browser, potentially allowing theft of session cookies, redirection to malicious sites, or other actions limited by the scope of reflected XSS. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin version or applying manual input sanitization and output escaping if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor vendor channels for updates and apply official patches promptly once available.