The WPExperts.io WP Multistore Locator plugin versions up to 2.4.7 contain a reflected XSS vulnerability due to improper neutralization of script-related HTML tags in web pages. This allows attackers to inject and execute arbitrary scripts when a victim interacts with crafted URLs or inputs, potentially leading to information disclosure, session hijacking, or other impacts typical of reflected XSS. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other user-impacting consequences. The CVSS score reflects a high severity with low complexity and no privileges required, but user interaction is necessary. The scope is changed, indicating the vulnerability affects components beyond the initially vulnerable code. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor WPExperts.io communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Avoid clicking on suspicious links that may exploit this vulnerability.