This vulnerability is a reflected cross-site scripting (XSS) issue in the 'Top Bar – PopUps – by WPOptin' WordPress plugin by Danish Ali Malik. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of users' browsers. The affected versions include all releases up to 2.0.8. The CVSS score of 7.1 reflects a high-severity risk with potential impacts on confidentiality, integrity, and availability. The vulnerability requires user interaction and can be exploited remotely without privileges. No official patch or vendor advisory is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected website, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The reflected nature means the attack requires a user to interact with a crafted link or input. The high CVSS score reflects these risks, but no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor the vendor's channels for updates or patches addressing this vulnerability. Avoid clicking on suspicious links that may exploit this reflected XSS vulnerability.