The EchBay Admin Security plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in the '_ebnonce' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The vulnerability affects all plugin versions up to and including 1.3.0. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. No patch or vendor advisory is currently available, and no exploits are known to be active.

An attacker can perform reflected cross-site scripting attacks by injecting malicious scripts via the '_ebnonce' parameter. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of web page content in the victim's browser. The attack requires user interaction (clicking a malicious link) and does not affect availability. The vulnerability does not require authentication, increasing its risk profile. However, no active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the EchBay Admin Security plugin, especially in environments with untrusted users. Employing web application firewalls (WAFs) that can detect and block reflected XSS payloads may provide temporary mitigation. Users should also educate users to avoid clicking suspicious links related to the affected plugin. Monitor the vendor's channels for updates or patches.