The Simple Locator plugin by Kyle Phillips suffers from a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This flaw affects all versions up to 2.0.4 and allows remote attackers to inject malicious scripts that execute in the context of the victim's browser when a crafted URL is visited. The CVSS 3.1 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The attack requires the victim to interact with a crafted link or page. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected Simple Locator plugin versions and apply web application firewall (WAF) rules to detect and block reflected XSS attempts. Avoid clicking on suspicious links that may trigger the vulnerability.