The wpeverest User Registration & Membership plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) due to improper neutralization of input in the 's' parameter. This affects all versions up to and including 4.0.4. An attacker can craft a malicious URL containing script code in the 's' parameter that executes in the context of a victim's browser if the victim clicks the link. The vulnerability requires user interaction and does not require authentication. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and is exploitable remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on suspicious links that may contain malicious scripts targeting the 's' parameter in this plugin. Monitoring for updates from the vendor wpeverest is recommended to apply any forthcoming patches promptly.