The Claire Ryan Author Showcase plugin version 1.4.3 and earlier contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted web content generated by the plugin. The vulnerability is network exploitable without privileges and requires user interaction. It impacts confidentiality, integrity, and availability to a limited extent, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The impact is limited by the need for user interaction and the reflected nature of the XSS. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected Author Showcase plugin versions. Implementing web application firewalls (WAFs) that detect and block reflected XSS payloads may provide temporary mitigation. Avoid clicking on suspicious links that could trigger the reflected XSS.