The WP Order By plugin for WordPress, up to version 1.4.2, contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to craft malicious URLs or inputs that, when processed by the plugin, result in script execution in the user's browser. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Order By plugin or applying any temporary mitigations recommended by the vendor. Avoid clicking on suspicious links that may exploit this reflected XSS vulnerability.