The LawPress – Law Firm Website Management plugin by ivanchernyakov suffers from a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This affects versions up to 1.4.5. An attacker can craft a malicious URL or input that, when visited or processed by a user, executes arbitrary scripts in the victim's browser. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is available to confirm remediation status.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. The attack requires user interaction and can be performed remotely over the network without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and URLs related to LawPress – Law Firm Website Management. Implementing web application firewalls or input validation at the application level may provide temporary mitigation, but official remediation should be prioritized once available.